CVE-2025-62718

OVERVIEW CVE-2025-62718 affects Axios, a widely-used HTTP client library for Node.js and browser environments. The vulnerability exists in versions prior to 1.15.0 and 0.31.0 and involves improper hostname normalization when processing NO_PROXY rules. Attackers can bypass proxy protections by crafting requests to loopback addresses in non-standard formats, such as localhost with a trailing dot or IPv6 literals, allowing traffic to reach internal services that should be protected. SEVERITY This critical vulnerability carries a CVSS score of 9.9, indicating maximum severity. The attack requires no authentication or user interaction and can be executed over the network with low complexity. The vulnerability enables proxy bypass and Server-Side Request Forgery (SSRF) attacks with high confidentiality impact, low integrity impact, and low availability impact across connected systems. Organizations using Axios without immediate patching face exposure of sensitive loopback and internal services to remote exploitation. EXPLOITATION STATUS There is no evidence of active exploitation in the wild, and this vulnerability is not listed on the Known Exploited Vulnerabilities catalog. The EPSS score of 0.0004 indicates minimal current exploitation likelihood, though this may increase as awareness spreads. Immediate patching to versions 1.15.0 or 0.31.0 is recommended, particularly for applications exposing Axios functionality in network-accessible services.