CVE-2026-67315
Fixed in a distro release EPSS <1%CVSS 6.9
axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address in shouldBypassProxy.js, allowing requests to 0.0.0.0 to bypass NO_PROXY rules. Attackers can supply 0.0.0.0 URLs to route requests through configured proxies, potentially exposing local services when the proxy can reach the destination.
Products: axios
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | axios | 1.18.0 |
| npm | axios | 0.33.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | awx | 24.6.1-r45 |
| Chainguard | azurite | 3.35.0-r2 |
| Chainguard | gitlab-rails-ce-18.1 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| Chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r2 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| Chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| Chainguard | jitsucom-jitsu-console | 2.11.0-r30 |
| Chainguard | kibana-8.17 | 8.17.10-r31 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r31 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r31 |
| Chainguard | kibana-8.19 | 8.19.18-r2 |
| Chainguard | kibana-8.19-bitnami | 8.19.18-r2 |
| Chainguard | kibana-8.19-iamguarded | 8.19.18-r2 |
| Chainguard | kibana-9.0 | 9.0.8-r34 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r34 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r34 |
| Chainguard | kibana-9.1 | 9.1.10-r30 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r30 |
| Chainguard | kibana-9.2 | 9.2.8-r18 |
| Chainguard | kibana-9.2-iamguarded | 9.2.8-r18 |
| Chainguard | kibana-9.3 | 9.3.8-r1 |
| Chainguard | kibana-9.3-iamguarded | 9.3.8-r1 |
| Chainguard | kibana-9.4 | 9.4.4-r3 |
| Chainguard | kibana-9.4-iamguarded | 9.4.4-r3 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r26 |
| Chainguard | langfuse-2 | 2.95.12-r35 |
| Chainguard | langfuse-2-worker | 2.95.12-r35 |
| Chainguard | langfuse-3 | 3.223.0-r0 |
| Chainguard | langfuse-3-compat | 3.225.7-r6 |
| Chainguard | langfuse-3-worker | 3.223.0-r0 |
| Chainguard | langfuse-fips-2 | 2.95.12-r38 |
| Chainguard | langfuse-fips-2-worker | 2.95.12-r38 |
| Chainguard | langfuse-fips-3 | 3.223.0-r0 |
| Chainguard | langfuse-fips-3-worker | 3.223.0-r0 |
| Chainguard | lerna | 9.0.7-r11 |
| Chainguard | librechat | 0.8.7-r5 |
| Chainguard | nextcloud-server-32 | 32.0.12-r6 |
| Chainguard | nextcloud-server-33 | 33.0.6-r8 |
| Chainguard | nextcloud-server-34 | 34.0.2-r4 |
| Chainguard | opensearch-dashboards-2 | 2.19.6-r7 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r21 |
| Chainguard | opensearch-dashboards-3 | 3.7.0-r11 |
| Chainguard | opensearch-dashboards-3-fips | 3.7.0-r7 |
| Chainguard | prism | 5.16.0-r1 |
| Chainguard | redisinsight | 3.8.0-r1 |
| Chainguard | semaphore | 2.18.29-r0 |
| Chainguard | wazuh-dashboard | 4.14.6-r6 |
| Chainguard | wazuh-dashboard-fips | 4.14.6-r6 |
| Chainguard | wazuh-dashboard-plugins | 4.14.6-r6 |
| Chainguard | wazuh-dashboard-plugins-fips | 4.14.7-r1 |
| Debian 14 | node-axios | 1.18.0-1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.1-0.5.hum1 |
| Red Hat hummingbird 1 | grafana13.1 | 0:13.1.1-0.5.2.hum1 |
| Ubuntu Pro 20.04 LTS | node-axios | no fix |
| Ubuntu Pro 22.04 LTS | node-axios | no fix |
| Ubuntu Pro 24.04 LTS | node-axios | no fix |
| Ubuntu Pro 26.04 LTS | node-axios | no fix |
| Wolfi | jitsucom-jitsu-console | 2.11.0-r30 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r26 |
| Wolfi | langfuse-3 | 3.223.0-r0 |
| Wolfi | langfuse-3-compat | 3.225.7-r6 |
| Wolfi | langfuse-3-worker | 3.223.0-r0 |
| Wolfi | lerna | 9.0.7-r11 |
| Wolfi | nextcloud-server-32 | 32.0.12-r6 |
| Wolfi | nextcloud-server-33 | 33.0.6-r8 |
| Wolfi | opensearch-dashboards-3 | 3.7.0-r11 |
| Wolfi | prism | 5.16.0-r1 |
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 |