Skip to content
Fencer Vulns
high 7.0

CVE-2025-62718 json

Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

published 2026-04-09 7 mo ago modified 2026-10-14 25 d ago also EUVD-2025-209381 , GHSA-3p68-rc4w-qgx5

cvss
7.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 68%
public exploits
0
none known

Summary

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

Patch / fix

  • npm axios 0.31.0, 1.15.0
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 0:2.5.20260422-3.el8ap
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 0:2.5.20260422-3.el9ap
  • Red Hat Cluster Observability Operator 1.5.0 1781116387, 1781116392, 1781116645, 1781116658, 1781116667
  • Red Hat multicluster engine for Kubernetes 2.6 1778511348
  • Red Hat multicluster engine for Kubernetes 2.8 1778383863
  • Red Hat Network Observability (NETOBSERV) 1.11.0 1778508956, 1778510461
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14 1783451729
  • Red Hat Red Hat Advanced Cluster Security 4.9 1779371594
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10 1779293013
  • Red Hat Red Hat Ansible Automation Platform 2.5 1780082949
  • Red Hat Red Hat Ansible Automation Platform 2.6 1779784904, 1787184682
  • Red Hat Red Hat Developer Hub 1.8 1776784286
  • Red Hat Red Hat Developer Hub 1.9 1777903262
  • Red Hat Red Hat Discovery 2 1778156756
  • Red Hat Red Hat Migration Toolkit 1.8 1783690532
  • Red Hat Red Hat OpenShift AI 2.25 1780467029, 1780467147
  • Red Hat Red Hat OpenShift AI 3.3 1778473763, 1778666987, 1779189627
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 1776744110, 1776795511
  • Red Hat Red Hat OpenShift Service Mesh 2.6 1776191302, 1776202125
  • Red Hat Red Hat OpenShift Service Mesh 3.0 1776151124, 1776151272
  • Red Hat Red Hat OpenShift Service Mesh 3.1 1776151106, 1776151270
  • Red Hat Red Hat OpenShift Service Mesh 3.2 1776149682, 1776155669
  • Red Hat Red Hat OpenShift Service Mesh 3.3 1776151134, 1776151277
  • Red Hat Red Hat Quay 3.10 1779822261
  • Red Hat Red Hat Quay 3.12 1779811412
  • Red Hat Red Hat Quay 3.14 1779689392
  • Red Hat Red Hat Quay 3.15 1780891395
  • Red Hat Red Hat Quay 3.16 1779204086
  • Red Hat Red Hat Quay 3.17 1779922205
  • node-axios Debian 14 1.15.0-1

debian advisories DEBIAN-CVE-2025-62718

  • node-axios Ubuntu Pro 20.04 LTS 0.19.0+dfsg-2ubuntu0.1~esm1
  • node-axios Ubuntu Pro 22.04 LTS 0.26.0+dfsg-1ubuntu0.1~esm1
  • node-axios Ubuntu Pro 24.04 LTS 1.6.8+dfsg-2ubuntu0.1~esm1
  • node-axios Ubuntu Pro 26.04 LTS 1.13.2+dfsg-1ubuntu0.1~esm1

ubuntu advisories UBUNTU-CVE-2025-62718

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.5-1.el8ap
  • receptor ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 1.6.5-1.el9ap
  • python3.12-click ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 8.3.3-1.el8ap
  • python3.12-click ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 8.3.3-1.el9ap
  • python3.12-pillow ansible automation platform 2.5 12.2.0-1.el8ap
  • python3.12-pillow ansible automation platform 2.5 12.2.0-1.el9ap
  • python3.12-cryptography ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 46.0.7-1.el8ap
  • python3.12-cryptography ansible automation platform inside 2.5, ansible automation platform developer 2.5, ansible automation platform 2.5 46.0.7-1.el9ap

red hat advisories RHSA-2026:24761

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-62718 updated cvss 7.0

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization

  • Red Hat Gatekeeper 3 redhat-user-workloads/gatekeeper-tenant/gatekeeper-operator-3-18/gatekeeper-3-18
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Applications 8 mta/mta-ui-rhel8, mta/mta-ui-rhel9, redhat-user-workloads/ocp-art-tenant/art-images
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Migration Toolkit for Containers redhat-user-workloads/ocp-art-tenant/art-images Red Hat Multicluster Engine for Kubernetes redhat-user-workloads/crt-redhat-acm-tenant/console-mce-mce-28, redhat-user-workloads/crt-redhat-acm-tenant/console-mce-mce-29, redhat-user-workloads/crt-redhat-acm-tenant/console-mce-mce-210, redhat-user-workloads/crt-redhat-acm-tenant/console-mce-mce-211, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-26/console-mce-mce-26, redhat-user-workloads/crt-redhat-acm-tenant/release-mce-27/console-mce-mce-27 Red Hat Network Observability Operator redhat-user-workloads/ocp-network-observab-tenant/network-observability-console-plugin-zstream, redhat-user-workloads/ocp-network-observab-tenant/network-observability-console-plugin-pf4-zstream
    affected: workaround, no fix available
  • Red Hat OpenShift Pipelines openshift-pipelines/pipelines-hub-ui-rhel8, redhat-user-workloads/tekton-ecosystem-tenant/1-20/hub-ui-rhel9, redhat-user-workloads/tekton-ecosystem-tenant/pipelines-hub-ui-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat OpenShift Service Mesh 2 redhat-user-workloads/service-mesh-tenant/kiali-2-6, redhat-user-workloads/service-mesh-tenant/kiali-2-6-ossmc Red Hat OpenShift Service Mesh 3 redhat-user-workloads/service-mesh-tenant/kiali-3-0, redhat-user-workloads/service-mesh-tenant/kiali-3-1, redhat-user-workloads/service-mesh-tenant/kiali-3-2, redhat-user-workloads/service-mesh-tenant/kiali-3-3, redhat-user-workloads/service-mesh-tenant/kiali-3-0-ossmc, redhat-user-workloads/service-mesh-tenant/kiali-3-1-ossmc, +2 more
    affected: workaround, no fix available
  • Red Hat 3scale API Management Platform 2 3scale-amp21/system, 3scale-amp22/system, 3scale-amp2/system-rhel7, 3scale-amp2/system-rhel8, 3scale-amp2/system-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Advanced Cluster Management for Kubernetes 2 redhat-user-workloads/crt-redhat-acm-tenant/console-acm-214, redhat-user-workloads/crt-redhat-acm-tenant/console-acm-215, redhat-user-workloads/crt-redhat-acm-tenant/console-acm-216 Red Hat Advanced Cluster Security 4 rhacs-eng/release-main
    affected: workaround, no fix available
  • Red Hat Ansible Automation Platform 2 automation-hub, automation-controller, redhat-user-workloads/es-team-tenant/automation-reports, ansible-automation-platform-24/lightspeed-rhel8-operator, redhat-user-workloads/ansible-tenant/ansible-automation-platform-26/gateway-rhel9
    affected: workaround, no fix available, no fix planned “Will not fix”
show 20 more
  • Red Hat build of Apache Camel - HawtIO 4 axios
    affected: workaround, no fix available
  • Red Hat build of Apicurio Registry 2 axios
    affected: workaround, no fix planned “Will not fix”
  • Red Hat build of Apicurio Registry 3 apicurio/apicurio-registry-ui-rhel8, apicurio/apicurio-registry-ui-rhel9, apicurio/apicurio-registry-gitops-sync-rhel9
    affected: workaround, no fix available
  • Red Hat Developer Hub 1 rhdh/backstage-community-plugin-catalog-backend-module-scaffolder-relation-processor
    affected: workaround, no fix planned “Will not fix”
  • Red Hat Discovery 2 redhat-user-workloads/discovery-tenant/discovery/discovery-ui Red Hat Enterprise Linux AI (RHEL AI) 3 rhelai3/bootc-cuda-rhel9, rhelai3/bootc-rocm-rhel9, rhelai3/disk-image-cuda-rhel9
    affected: workaround, no fix available
  • Red Hat Fuse 7 axios
    affected: workaround, no fix available “Fix deferred”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-maas-rhel9 Red Hat OpenShift Container Platform 4 openshift3/ose-console, openshift4/ose-console Red Hat OpenShift Dev Spaces redhat-user-workloads/devspaces-tenant/devspaces/code-rhel9, redhat-user-workloads/devspaces-tenant/devspaces/dashboard-rhel9 Red Hat OpenShift Virtualization 4 container-native-virtualization/kubevirt-console-plugin, container-native-virtualization/kubevirt-console-plugin-rhel9, openshift-virtualization/konflux-builds/v4-21/kubevirt-console-plugin-rhel9 Red Hat Quay 3 redhat-user-workloads/quay-eng-tenant/quay-quay-v3-9, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-10, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-12, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-13, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-14, redhat-user-workloads/quay-eng-tenant/quay-quay-v3-15, +2 more Red Hat Satellite 6 redhat-user-workloads/insights-management-tenant/satellite-iop/iop-advisor-frontend-sat-6-18, redhat-user-workloads/insights-management-tenant/satellite-iop/iop-host-inventory-frontend-sat-6-18
    +1 more products
    Red Hat Trusted Artifact Signer securesign/rhtas-console-ui
    affected: workaround, no fix available
  • Red Hat Trusted Profile Analyzer rhtpa/rhtpa-trustification-service-rhel9, redhat-user-workloads/trusted-content-tenant/rhtpa-product-0-3-z, redhat-user-workloads/trusted-content-tenant/rhtpa-product-0-4-z
    affected: workaround, no fix available, no fix planned “Will not fix”
  • Red Hat Self-service automation portal 2 redhat-user-workloads/ansible-plugins-tenant/ansible-plugins
    affected: workaround, no fix available
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/monitoring-console-plugin-pf5-rhel9 1781116667, cluster-observability-operator/distributed-tracing-console-plugin-rhel9 1781116392, cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 1781116645, cluster-observability-operator/distributed-tracing-console-plugin-pf5-rhel9 1781116658, cluster-observability-operator/distributed-tracing-console-plugin-pf6-rhel9 1781116387
    fixed: vendor fix RHSA-2026:26010
  • Red Hat multicluster engine for Kubernetes 2.6 multicluster-engine 1778511348
    fixed: vendor fix RHSA-2026:17657
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine 1778383863
    fixed: vendor fix RHSA-2026:17699
  • Red Hat Network Observability (NETOBSERV) 1.11.0 network-observability 1778508956, network-observability 1778510461
    fixed: vendor fix RHSA-2026:16874
  • Red Hat Advanced Cluster Management for Kubernetes 2.14 rhacm2/console-rhel9 1783451729
    fixed: vendor fix RHSA-2026:36882
  • Red Hat Advanced Cluster Security 4.9 advanced-cluster-security/rhacs-main-rhel8 1779371594
    fixed: vendor fix RHSA-2026:20938
  • Red Hat Advanced Cluster Security for Kubernetes for IBM Power, little endian 4.10 advanced-cluster-security 1779293013
    fixed: vendor fix RHSA-2026:20889
  • Red Hat Ansible Automation Platform 2.5 ansible-automation-platform-25/lightspeed-rhel8 1780082949
    fixed: vendor fix RHSA-2026:24766
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-server 2.5.20260422-3.el8ap Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-server 2.5.20260422-3.el9ap
    fixed: vendor fix RHSA-2026:24761
  • Red Hat Ansible Automation Platform 2.6 ansible-automation-platform-26/lightspeed-rhel9 1779784904, ansible-automation-platform-26/lightspeed-rhel9-operator 1787184682
    fixed: vendor fix RHSA-2026:59155
  • Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
    fixed: vendor fix RHSA-2026:86618

22 more fixed, 45 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
7 mo ago

Exploit prediction

1.21% chance of exploitation in the next 30 days, higher than 68% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
CISA ADP 3.1 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
GitHub 3.1 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
CNA 4.0 6.3 CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD 3.1 9.9 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
CNA 3.1 7.0 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Affected packages

ecosystem package affected fixed in
npm axios
>=1.0.0, <1.15.0
<0.31.0
1.15.0
0.31.0

Affected products

  • axios axios
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Streams for Apache Kafka 3.2.0
  • Red Hat Cluster Observability Operator 1.5.0
  • Red Hat multicluster engine for Kubernetes 2.6
  • Red Hat multicluster engine for Kubernetes 2.8
  • Red Hat Network Observability (NETOBSERV) 1.11.0
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2.14
  • Red Hat Red Hat Advanced Cluster Security 4.9
  • Red Hat Red Hat Advanced Cluster Security for Kubernetes 4.10
  • Red Hat Red Hat Ansible Automation Platform 2.5
  • Red Hat Red Hat Ansible Automation Platform 2.6
  • Red Hat Red Hat Developer Hub 1.8
  • Red Hat Red Hat Developer Hub 1.9
  • Red Hat Red Hat Discovery 2
  • Red Hat Red Hat Migration Toolkit 1.8
  • Red Hat Red Hat OpenShift AI 2.25
  • Red Hat Red Hat OpenShift AI 3.3
  • Red Hat Red Hat OpenShift Dev Spaces 3.27
  • Red Hat Red Hat OpenShift Service Mesh 2.6
  • Red Hat Red Hat OpenShift Service Mesh 3.0
  • Red Hat Red Hat OpenShift Service Mesh 3.1
  • Red Hat Red Hat OpenShift Service Mesh 3.2
  • Red Hat Red Hat OpenShift Service Mesh 3.3
  • Red Hat Red Hat Quay 3.10
  • Red Hat Red Hat Quay 3.12
  • Red Hat Red Hat Quay 3.14
  • Red Hat Red Hat Quay 3.15
  • Red Hat Red Hat Quay 3.16
  • Red Hat Red Hat Quay 3.17
  • Red Hat Red Hat Quay 3.9
  • Red Hat Red Hat Trusted Artifact Signer 1.3
  • Red Hat Cryostat 4
  • Red Hat Gatekeeper 3
  • Red Hat Migration Toolkit for Applications 8
  • Red Hat Multicluster Engine for Kubernetes
  • Red Hat Network Observability Operator
  • Red Hat OpenShift Pipelines
  • Red Hat OpenShift Service Mesh 2
  • Red Hat OpenShift Service Mesh 3
  • Red Hat Red Hat 3scale API Management Platform 2
  • Red Hat Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Red Hat Ansible Automation Platform 2
  • Red Hat Red Hat build of Apache Camel - HawtIO 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat Build of Kueue
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Developer Hub

Classification

Weakness
  • CWE-441 Unintended Proxy or Intermediary
  • CWE-918 Server-Side Request Forgery
  • CWE-1289 Improper Validation of Unsafe Equivalence in Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.