EUVD-2025-209381Published
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a traili…
Exact source revision recorded 3 Nov 2026 02:06:47 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2025-62718 · Microsoft / collected KEV context
euvd · EUVD-2025-209381
- https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5
- https://github.com/axios/axios/pull/10661
- https://github.com/axios/axios/pull/10688
- https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c
- https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df
- https://datatracker.ietf.org/doc/html/rfc1034#section-3.1
- https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
- https://github.com/axios/axios/releases/tag/v0.31.0
- https://github.com/axios/axios/releases/tag/v1.15.0
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.