You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Axios does not correctly handle hostname normalization when checking NO_PROXY rules.
Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy.
This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services.
According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level, localhost. is the same as localhost.
However, Axios does a literal string comparison instead of normalizing hostnames before checking NO_PROXY. This causes requests like http://localhost.:8080/ and http://[::1]:8080/ to be incorrectly proxied.
This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.
PoC
importhttpfrom"http";importaxiosfrom"axios";constproxyPort=5300;http.createServer((req,res)=>{console.log("[PROXY] Got:",req.method,req.url,"Host:",req.headers.host);res.writeHead(200,{"Content-Type": "text/plain"});res.end("proxied");}).listen(proxyPort,()=>console.log("Proxy",proxyPort));process.env.HTTP_PROXY=`http://127.0.0.1:${proxyPort}`;process.env.NO_PROXY="localhost,127.0.0.1,::1";asyncfunctiontest(url){try{awaitaxios.get(url,{timeout: 2000});}catch{}}setTimeout(async()=>{console.log("\n[*] Testing http://localhost.:8080/");awaittest("http://localhost.:8080/");// goes through proxyconsole.log("\n[*] Testing http://[::1]:8080/");awaittest("http://[::1]:8080/");// goes through proxy},500);
Expected: Requests bypass the proxy (direct to loopback). Actual: Proxy logs requests for localhost. and [::1].
Impact
Applications that rely on NO_PROXY=localhost,127.0.0.1,::1 for protecting loopback/internal access are vulnerable.
Attackers controlling request URLs can:
Force Axios to send local traffic through an attacker-controlled proxy.
Bypass SSRF mitigations relying on NO_PROXY rules.
Potentially exfiltrate sensitive responses from internal services via the proxy.
Affected Versions
Confirmed on Axios 1.12.2 (latest at time of testing).
affects all versions that rely on Axios’ current NO_PROXY evaluation.
Remediation
Axios should normalize hostnames before evaluating NO_PROXY, including:
Strip trailing dots from hostnames (per RFC 3986).
Normalize IPv6 literals by removing brackets for matching.
Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Summary
The Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass).
While Axios patches exist for preventing check pollution, the library remains vulnerable to being used as a gadget when pollution occurs elsewhere. This is due to a lack of HTTP Header Sanitization (CWE-113) combined with default SSRF capabilities.
This vulnerability is unique because it requires Zero Direct User Input.
If an attacker can pollute Object.prototype via any other library in the stack (e.g., qs, minimist, ini, body-parser), Axios will automatically pick up the polluted properties during its config merge.
Because Axios does not sanitise these merged header values for CRLF (\r\n) characters, the polluted property becomes a Request Smuggling payload.
Proof of Concept
1. The Setup (Simulated Pollution)
Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:
The "Smuggled" second request is a valid PUT request to the AWS Metadata Service. It includes the required X-aws-ec2-metadata-token-ttl-seconds header (which a normal SSRF cannot send).
The Metadata Service returns a session token, allowing the attacker to steal IAM credentials and compromise the cloud account.
Impact Analysis
Security Control Bypass: Defeats AWS IMDSv2 (Session Tokens).
Authentication Bypass: Can inject headers (Cookie, Authorization) to pivot into internal administrative panels.
Cache Poisoning: Can inject Host headers to poison shared caches.
Recommended Fix
Validate all header values in lib/adapters/http.js and xhr.js before passing them to the underlying request function.
Patch Suggestion:
// In lib/adapters/http.jsutils.forEach(requestHeaders,functionsetRequestHeader(val,key){if(/[\r\n]/.test(val)){thrownewError('Security: Header value contains invalid characters');}// ... proceed to set header});
References
OWASP: CRLF Injection (CWE-113)
This report was generated as part of a security audit of the Axios library.
Added a clear() function to the request and response interceptors object so a user can ensure that all interceptors have been removed from an axios instance #4248
There are multiple deprecations, refactors and fixes provided in this release. Please read through the full release notes to see how this may impact your project and use case.
Removed
Removed incorrect argument for NetworkError constructor #4656
This release focuses on platform compatibility, error handling improvements, and code quality maintenance.
⚠️ Important Changes
Breaking Changes: None identified in this release.
Action Required: Users targeting React Native should verify their integration, particularly if relying on specific Blob or FormData behaviours, as improvements have been made to support these objects.
🚀 New Features
React Native Blob Support: Axios now includes support for React Native Blob objects. Thanks to @moh3n9595 for the initial implementation. (#5764)
Code Quality: Implemented prettier across the codebase and resolved associated formatting issues. (#7385)
🐛 Bug Fixes
Environment Compatibility:
Fixed module exports for React Native and Browserify environments. (#7386)
Added safe FormData detection for the WeChat Mini Program environment. (#7324)
Error Handling:
AxiosError.message is now correctly enumerable. (#7392)
AxiosError.from now correctly copies the status property from the source error, ensuring better error propagation. (#7403)
🔧 Maintenance & Chores
Dependencies: Updated the development_dependencies group (5 updates). (#7432)
Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.
This PR includes no changesets
When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
1.13.5→1.15.0GitHub Vulnerability Alerts
CVE-2025-62718
Axios does not correctly handle hostname normalization when checking
NO_PROXYrules.Requests to loopback addresses like
localhost.(with a trailing dot) or[::1](IPv6 literal) skipNO_PROXYmatching and go through the configured proxy.This goes against what developers expect and lets attackers force requests through a proxy, even if
NO_PROXYis set up to protect loopback or internal services.According to RFC 1034 §3.1 and RFC 3986 §3.2.2, a hostname can have a trailing dot to show it is a fully qualified domain name (FQDN). At the DNS level,
localhost.is the same aslocalhost.However, Axios does a literal string comparison instead of normalizing hostnames before checking
NO_PROXY. This causes requests likehttp://localhost.:8080/andhttp://[::1]:8080/to be incorrectly proxied.This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections.
PoC
Expected: Requests bypass the proxy (direct to loopback).
Actual: Proxy logs requests for
localhost.and[::1].Impact
Applications that rely on
NO_PROXY=localhost,127.0.0.1,::1for protecting loopback/internal access are vulnerable.Attackers controlling request URLs can:
Affected Versions
NO_PROXYevaluation.Remediation
Axios should normalize hostnames before evaluating
NO_PROXY, including:CVE-2026-40175
Vulnerability Disclosure: Unrestricted Cloud Metadata Exfiltration via Header Injection Chain
Summary
The Axios library is vulnerable to a specific "Gadget" attack chain that allows Prototype Pollution in any third-party dependency to be escalated into Remote Code Execution (RCE) or Full Cloud Compromise (via AWS IMDSv2 bypass).
While Axios patches exist for preventing check pollution, the library remains vulnerable to being used as a gadget when pollution occurs elsewhere. This is due to a lack of HTTP Header Sanitization (CWE-113) combined with default SSRF capabilities.
Severity: Critical (CVSS 9.9)
Affected Versions: All versions (v0.x - v1.x)
Vulnerable Component:
lib/adapters/http.js(Header Processing)Usage of "Helper" Vulnerabilities
This vulnerability is unique because it requires Zero Direct User Input.
If an attacker can pollute
Object.prototypevia any other library in the stack (e.g.,qs,minimist,ini,body-parser), Axios will automatically pick up the polluted properties during its config merge.Because Axios does not sanitise these merged header values for CRLF (
\r\n) characters, the polluted property becomes a Request Smuggling payload.Proof of Concept
1. The Setup (Simulated Pollution)
Imagine a scenario where a known vulnerability exists in a query parser. The attacker sends a payload that sets:
2. The Gadget Trigger (Safe Code)
The application makes a completely safe, hardcoded request:
3. The Execution
Axios merges the prototype property
x-amz-targetinto the request headers. It then writes the header value directly to the socket without validation.Resulting HTTP traffic:
4. The Impact (IMDSv2 Bypass)
The "Smuggled" second request is a valid
PUTrequest to the AWS Metadata Service. It includes the requiredX-aws-ec2-metadata-token-ttl-secondsheader (which a normal SSRF cannot send).The Metadata Service returns a session token, allowing the attacker to steal IAM credentials and compromise the cloud account.
Impact Analysis
Cookie,Authorization) to pivot into internal administrative panels.Hostheaders to poison shared caches.Recommended Fix
Validate all header values in
lib/adapters/http.jsandxhr.jsbefore passing them to the underlying request function.Patch Suggestion:
References
This report was generated as part of a security audit of the Axios library.
Release Notes
axios/axios (axios)
v1.15.0Compare Source
Bug Fixes
Features
Contributors to this release
PRs
1.2.6 (2023-01-28)
Bug Fixes
CommonRequestHeadersList&CommonResponseHeadersListtypes to be private in commonJS; (#5503) (5a3d0a3)Contributors to this release
PRs
1.2.5 (2023-01-26)
Bug Fixes
Contributors to this release
PRs
1.2.4 (2023-01-22)
Bug Fixes
RawAxiosRequestConfigback toAxiosRequestConfig; (#5486) (2a71f49)AxiosRequestConfiggeneric; (#5478) (9bce81b)Contributors to this release
PRs
1.2.3 (2023-01-10)
Bug Fixes
Contributors to this release
PRs
[1.2.2] - 2022-12-29
Fixed
Chores
Contributors to this release
[1.2.1] - 2022-12-05
Changed
Fixed
Refactors
Chores
Contributors to this release
PRs
[1.2.0] - 2022-11-10
Changed
Fixed
Refactors
Chores
Contributors to this release
PRs
[1.1.3] - 2022-10-15
Added
Fixed
Chores
Contributors to this release
PRs
[1.1.2] - 2022-10-07
Fixed
Contributors to this release
PRs
[1.1.1] - 2022-10-07
Fixed
Contributors to this release
PRs
[1.1.0] - 2022-10-06
Fixed
Contributors to this release
PRs
[1.0.0] - 2022-10-04
Added
Changed
Deprecated
Removed
Fixed
Chores
Security
Contributors to this release
Bertrand Marron
Dmitriy Mozgovoy
Dan Mooney
Michael Li
aong
Des Preston
Ted Robertson
zhoulixiang
Arthur Fiorette
Kumar Shanu
JALAL
Jingyi Lin
Philipp Loose
Alexander Shchukin
Dave Cardwell
Cat Scarlet
Luca Pizzini
Kai
Maxime Bargiel
Brian Helba
reslear
Jamie Slome
Landro3
rafw87
Afzal Sayed
Koki Oyatsu
Dave
暴走老七
Spencer
Adrian Wieprzkowicz
Jamie Telin
毛呆
Kirill Shakirov
Rraji Abdelbari
Jelle Schutter
Tom Ceuppens
Johann Cooper
Dimitris Halatsis
chenjigeng
João Gabriel Quaresma
Victor Augusto
neilnaveen
Pavlos
Kiryl Valkovich
Naveen
wenzheng
hcwhan
Bassel Rachid
Grégoire Pineau
felipedamin
Karl Horky
Yue JIN
Usman Ali Siddiqui
WD
Günther Foidl
Stephen Jennings
C.T.Lin
mia-z
Parth Banathia
parth0105pluang
Marco Weber
Luca Pizzini
Willian Agostini
Huyen Nguyen
v1.14.0Compare Source
v1.13.6Compare Source
This release focuses on platform compatibility, error handling improvements, and code quality maintenance.
🚀 New Features
🐛 Bug Fixes
Environment Compatibility:
Error Handling:
🔧 Maintenance & Chores
🌟 New Contributors
We are thrilled to welcome our new contributors! Thank you for helping improve the project:
Full Changelog: v1.13.5...v1.13.6
Configuration
📅 Schedule: (UTC)
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.