CVE-2026-67315: Axios Auth Bypass Vulnerability

CVE-2026-67315 Overview

CVE-2026-67315 affects the axios HTTP client library for JavaScript. The vulnerability resides in shouldBypassProxy.js, which fails to recognize 0.0.0.0 as a loopback address. Requests targeting 0.0.0.0 bypass configured NO_PROXY rules and route through the proxy instead. Attackers who control request URLs can leverage this behavior to reach local services accessible from the proxy host. The issue affects axios versions 0.31.0 through 0.32.x and 1.15.0 through 1.17.x. This is a proxy bypass rooted in a permissive list check [CWE-183].

Critical Impact
Supplying 0.0.0.0 URLs to an application using vulnerable axios can expose internal services when the outbound proxy can reach the target host.

Affected Products

axios versions 0.31.0 before 0.33.0
axios versions 1.15.0 before 1.18.0
Node.js applications and services depending on affected axios releases

Discovery Timeline

2026-08-01 - CVE-2026-67315 published to NVD
2026-08-03 - Last updated in NVD database

Technical Details for CVE-2026-67315

Vulnerability Analysis

The axios library evaluates the NO_PROXY environment variable to decide whether to bypass the configured proxy for a request. The logic lives in shouldBypassProxy.js. That function normalizes hostnames such as localhost and 127.0.0.1 to keep loopback traffic off the proxy. However, it omits 0.0.0.0 from its loopback set. On most operating systems, 0.0.0.0 resolves to the local machine for outbound sockets or is treated as a wildcard address that maps to loopback services listening on all interfaces. Because the bypass check misses this case, axios forwards 0.0.0.0 requests through the proxy defined by HTTP_PROXY or HTTPS_PROXY.

Root Cause

The root cause is an incomplete list of loopback identifiers used by the proxy bypass logic. This is a classic permissive list weakness where the allowlist omits a semantically equivalent value. The check compares literal hostname strings rather than resolving addresses or covering the full IPv4 unspecified/loopback range.

Attack Vector

Exploitation requires an attacker to influence the URL passed to axios in an application that runs behind an outbound HTTP proxy. When the URL host is set to 0.0.0.0, axios sends the request through the proxy. If the proxy can reach services bound to 0.0.0.0 or the loopback interface on internal hosts, the attacker can read responses or trigger actions on those services. Server-side request forgery scenarios and multi-tenant proxy deployments are the primary exposure paths. See the GitHub Security Advisory and the VulnCheck Advisory for detailed technical context.

Detection Methods for CVE-2026-67315

Indicators of Compromise

Outbound proxy logs showing HTTP requests with a Host header or request line targeting 0.0.0.0.
Application logs recording user-supplied URLs whose hostname resolves to or literally equals 0.0.0.0.
Unexpected proxy-originated traffic reaching internal management interfaces or metadata services.

Detection Strategies

Inventory Node.js projects and inspect package-lock.json or yarn.lock for axios versions in the vulnerable ranges 0.31.0–0.32.x and 1.15.0–1.17.x.
Use Software Composition Analysis (SCA) tooling to flag installations of vulnerable axios releases across build pipelines.
Add web application firewall or gateway rules that reject inbound requests where user-controlled URL parameters resolve to 0.0.0.0.

Monitoring Recommendations

Alert on proxy access logs that record 0.0.0.0 or unusual RFC1918 destinations originating from application service accounts.
Monitor egress from application servers for traffic patterns that indicate SSRF probing against loopback ports.
Track dependency updates and CI build outputs so downgrades to vulnerable axios versions raise a security event.

How to Mitigate CVE-2026-67315

Immediate Actions Required

Upgrade axios to 0.33.0 or later on the 0.x branch, or to 1.18.0 or later on the 1.x branch.
Audit application code for any place that passes user-controlled URLs directly to axios and enforce strict host allowlisting.
Restrict what internal destinations the outbound proxy is permitted to reach, especially management interfaces and cloud metadata endpoints.

Patch Information

The axios maintainers fixed the bypass by extending shouldBypassProxy.js to treat 0.0.0.0 as a loopback address. The corrected releases are axios@0.33.0 and axios@1.18.0. Upgrade guidance is published in the GitHub Security Advisory GHSA-f4gw-2p7v-4548.

Workarounds

Validate and canonicalize URLs before passing them to axios, rejecting hosts equal to 0.0.0.0, 127.0.0.0/8, ::, or ::1.
Configure the outbound proxy to deny CONNECT and forward requests destined for loopback and unspecified addresses.
Where feasible, unset HTTP_PROXY and HTTPS_PROXY for services that do not require an outbound proxy, eliminating the bypass surface.

bash

# Configuration example
npm install axios@^1.18.0
# or for the 0.x line
npm install axios@^0.33.0

# Verify installed version
npm ls axios