Skip to content
Threat Feed

Tag

No_proxy

1 brief RSS
critical advisory

Axios NO_PROXY Hostname Normalization Bypass Leads to SSRF

Axios is vulnerable to a NO_PROXY hostname normalization bypass leading to SSRF, where requests to loopback addresses like `localhost.` or `[::1]` bypass `NO_PROXY` rules, allowing attackers to force requests through a proxy and potentially exfiltrate sensitive data.

ssrf no_proxy axios hostname_normalization
2r 1t 1c