Description
Axios: no_proxy bypass via IP alias allows SSRF
The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it.
The shouldBypassProxy() function does pure string matching — it does not
resolve IP aliases or loopback equivalents. As a result:
no_proxy=localhost does NOT block 127.0.0.1 or [::1]
no_proxy=127.0.0.1 does NOT block localhost or [::1]
POC :
process.env.no_proxy = 'localhost';
process.env.http_proxy = 'http://attacker-proxy:8888 ';
process.env.http_proxy = 'http://127.0.0.1:8888';
console.log('=== Test 1: localhost (should bypass proxy) ===');
try {
await axios.get('http://localhost:7777/');
} catch(e) {
console.log('Error:', e.message);
}...Show more
Mitigation
Minimal update. May introduce new vulnerabilities or breaking changes.
debian 11
=0.21.1+dfsg-1 || =0.21.1+dfsg-1+deb11u1 || =0.21.3+dfsg-1 || =0.21.4+dfsg-1 || =0.22.0+dfsg-1 || =0.23.0+dfsg-1 || =0.23.0+dfsg-2 || =0.24.0+dfsg-1 || =0.25.0+dfsg-1 || =0.25.0+dfsg-2 || =0.26.0+dfsg-1 || =0.26.1+dfsg-1 || =0.26.1+dfsg-2 || =0.27.2+dfsg-1 || =0.27.2+dfsg-2 || =1.1.2+dfsg-1 || =1.1.2+dfsg-2 || =1.1.2+dfsg-3 || =1.1.3+dfsg-1 || =1.1.3+dfsg-2 || =1.11.0+dfsg-1 || =1.12.1+dfsg-1 || =1.13.1+dfsg-1 || =1.13.2+dfsg-1 || =1.14.0+dfsg-1 || =1.15.0-1 || =1.15.2-1 || =1.16.0-1 || =1.18.0-1 || =1.2.0+dfsg-1 || =1.2.1+dfsg-1 || =1.5.1+dfsg-1 || =1.6.2+dfsg-1 || =1.6.8+dfsg-1 || =1.6.8+dfsg-2 || =1.7.3+dfsg-1 || =1.7.4+dfsg-1 || =1.7.7+dfsg-1 || =1.7.9+dfsg-1 || =1.8.4+dfsg-1
-
debian 12
=1.11.0+dfsg-1 || =1.12.1+dfsg-1 || =1.13.1+dfsg-1 || =1.13.2+dfsg-1 || =1.14.0+dfsg-1 || =1.15.0-1 || =1.15.2-1 || =1.16.0-1 || =1.18.0-1 || =1.2.1+dfsg-1 || =1.2.1+dfsg-1+deb12u1 || =1.5.1+dfsg-1 || =1.6.2+dfsg-1 || =1.6.8+dfsg-1 || =1.6.8+dfsg-2 || =1.7.3+dfsg-1 || =1.7.4+dfsg-1 || =1.7.7+dfsg-1 || =1.7.9+dfsg-1 || =1.8.4+dfsg-1
-
debian 14
=1.11.0+dfsg-1 || =1.12.1+dfsg-1 || =1.13.1+dfsg-1 || =1.13.2+dfsg-1 || =1.14.0+dfsg-1 || =1.15.0-1 || =1.8.4+dfsg-1 || >=0 <1.15.2-1
1.15.2-1
rpm rhel8
-
-
rpm rhel9
-
-
npm
>=1.0.0 <1.15.1 || >=0 <0.31.1
1.15.1, 0.31.1
debian 13
=1.11.0+dfsg-1 || =1.12.1+dfsg-1 || =1.13.1+dfsg-1 || =1.13.2+dfsg-1 || =1.14.0+dfsg-1 || =1.15.0-1 || =1.15.2-1 || =1.16.0-1 || =1.18.0-1 || =1.8.4+dfsg-1
-
