GHSA-pmwg-cvhr-8vh7
High · 7.2CVSS
7.2
EPSS
—
Published
May 5, 2026
CISA due date
—
The record
Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | axios | 0 | 0.31.1 |
| npm | axios | 1.0.0 | 1.15.1 |
Related vulnerabilities
- CVE-2026-42043 Axios is a promise based HTTP client for the browser and Node.js. Same vulnerability
- CVE-2026-44496 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44490 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44492 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44494 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44495 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44486 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios
- CVE-2026-44487 Axios is a promise based HTTP client for the browser and Node.js. Also affects axios