CVE-2025-62718

high Red Hat
CVSS v3 Base Score
7.0
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L
EPSS Score
0.1%
Exploitation probability in 30 days
Top 79% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Confidentiality
High
Integrity
Low
Availability
Low
Published: April 9, 2026 (92 days ago)
Last Modified: April 9, 2026
Vendor: Red Hat
Fix Available: ✓ Yes
Source: REDHAT

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

CWE

CWE-1289

Affected Products

Cryostat 4Gatekeeper 3Migration Toolkit for Applications 8Migration Toolkit for ContainersMulticluster Engine for KubernetesNetwork Observability OperatorOpenShift PipelinesOpenShift Service Mesh 2OpenShift Service Mesh 3Red Hat 3scale API Management Platform 2

Fix Status

✅ Fix Available

References

🔗 bugzilla.redhat.com 🔗 www.cve.org 🔗 nvd.nist.gov 🔗 datatracker.ietf.org 🔗 datatracker.ietf.org