GHSA-f4gw-2p7v-4548 Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios
SummaryAxios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:<port>/` can be routed through the configured proxy instead of bypassing it.The issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when the proxy can reach or relay `0.0.0.0` to local services. This is a Node.js runtime proxy-routing issue, not a browser, install-time, or development-tooling issue.ImpactApplications are affected when all of the following are true:The application runs axios in Node.js with the HTTP adapter.The process uses environment proxy variables such as `HTTP_PROXY` or `HTTPS_PROXY`.The process uses `NO_PROXY` entries such as `localhost`, `127.0.0.1`, or `::1` to keep local traffic out of the proxy path.Attacker-controlled input can influence the request URL or redirect target.The configured proxy does not reject `0.0.0.0` and can reach the local destination.For plain HTTP targets, the proxy can receive the full request URL, headers, and body, and may be able to observe the local service response. HTTPS targets are less exposed because axios uses CONNECT tunneling in current versions.Affected FunctionalityAffected functionality is limited to environment-derived proxy selection in the Node HTTP adapter:`lib/adapters/http.js` calls `getProxyForUrl(location)` and then `shouldBypassProxy(location)` before applying the proxy.`lib/helpers/shouldBypassProxy.js` normalizes and compares `NO_PROXY` entries.Explicit caller-provided `config.proxy` remains trusted caller configuration.Browser, React Native, XHR, and fetch adapter behavior are not affected.Technical Details`lib/helpers/shouldBypassProxy.js` defines local loopback equivalence through `isLoopback()`. The current implementation recognizes `localhost`, IPv4 `127.0.0.0/8`, IPv6 `::1`, and IPv4-mapped loopback forms, but it does not include `0.0.0.0`.At `lib/helpers/shouldBypassProxy.js:176`, axios treats two hosts as matching when both are considered loopback:Because `isLoopback('0.0.0.0')` returns `false`, `NO_PROXY=localhost,127.0.0.1,::1` does not match `http://0.0.0.0:<port>/`. `lib/adapters/http.js:185-193` then applies the environment proxy.Proof of Concept of AttackExpected safe behavior: both `127.0.0.1` and `0.0.0.0` bypass the proxy when the `NO_PROXY` policy is intended to cover local destinations.Observed behavior: `127.0.0.1` bypasses the proxy, while `0.0.0.0` is sent through the proxy.WorkaroundsAdd `0.0.0.0` explicitly to `NO_PROXY` where local addresses must bypass proxies.Reject or normalize `0.0.0.0` in application URL validation before calling axios.Set `proxy: false` on axios requests that must never use environment proxies.Configure the proxy itself to reject `0.0.0.0`, loopback, link-local, and internal address ranges.Summary`axios` versions 1.15.0–1.16.1 contain an incomplete loopback-address check in `lib/helpers/shouldBypassProxy.js`. The `isLoopback()` function correctly identifies `127.0.0.0/8` and `::1` as loopback addresses but does not recognise `0.0.0.0` — the IPv4 unspecified address, which routes to the local machine on Linux and macOS.An attacker who controls a URL passed to axios can use `http://0.0.0.0/<path>` to bypass proxy-based SSRF filtering that the application relies upon.DetailsAffected versions`>= 1.15.0, <= 1.16.1`The vulnerability was introduced in v1.15.0 when the `shouldBypassProxy` helper was added as a security improvement (PR #10661).Root cause**File:** `lib/helpers/shouldBypassProxy.js`
CVSS v4.0 score: 6.9