Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request c…

Axios HTTP client library contains a vulnerability that allows attackers to bypass NO_PROXY protection by using addresses in the 127.0.0.0/8 range other than 127.0.0.1. This affects versions prior to 1.15.1 and 0.31.1 in both browser and Node.js environments. The vulnerability stems from an incomplete fix for CVE-2025-62718. Attackers who can influence the target URL of an Axios request can exploit this to circumvent proxy restrictions. The issue has been resolved in versions 1.15.1 and 0.31.1.