{"id":"CVE-2026-67315","title":"axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules","summary":"axios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured pr…","severity":"none","cwe":["CWE-183"],"published":"2026-08-01","updated":"2026-08-01","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-67315","references":[{"url":"https://github.com/axios/axios/security/advisories/GHSA-f4gw-2p7v-4548","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/axios-before-no-proxy-bypass-via","label":"disclosure@vulncheck.com"}],"tags":["nvd"],"ingestedAt":"2026-08-02T07:18:01.899Z","epss":0.00331,"epssPercentile":0.26431,"slug":"CVE-2026-67315","body":"## Overview\n\naxios versions 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}