Attestkeep
Dil: Türkçe
Kayıt ol

Zafiyetler / CVE-2025-62718

kritik

CVE-2025-62718

axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization

Yayın Değişiklik CWE 441, 918, 1289
En geç 24 Eki 2026, 07:11 UTC tarihinden beri Trivy database'indeO derlemeden önce ne zaman girdiği kayıtlı değil.

Kaynağa göre önem derecesi

NVD9.9CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L
GHSA6.3CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
Red Hat7.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L

Trivy'nin kendi etiketi CRITICAL. Kritik diyenler: NVD. Daha düşük diyenler: Red Hat (yüksek), GHSA (orta), Ubuntu (orta).

Açıklama

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (IPv6 literal) skip NO_PROXY matching and go through the configured proxy. This goes against what developers expect and lets attackers force requests through a proxy, even if NO_PROXY is set up to protect loopback or internal services. This issue leads to the possibility of proxy bypass and SSRF vulnerabilities allowing attackers to reach sensitive loopback or internal services despite the configured protections. This vulnerability is fixed in 1.15.0 and 0.31.0.

Etkilenen paketler ve düzeltilmiş sürümler

KaynakPaketDüzeltildiği sürüm
chainguardarangodb-3.11, awx, gitlab-rails-ce-18.11 ve 37 tane daha3.11.14.5-r14 ve 38 tane daha
debian 11node-axiosdüzeltme belirtilmemiş
debian 12node-axiosdüzeltme belirtilmemiş
debian 13node-axiosdüzeltme belirtilmemiş
debian 14node-axios1.15.0-1
echonode-axiosdüzeltme belirtilmemiş
echo npm::Echo OSVaxios1.14.0+echo.1
minimoscube-1.7, kibana-8.19, kibana-9.3 ve 4 tane daha1.7.36-r0 ve 5 tane daha
npm::GitHub Security Advisory npmaxios1.15.0, 0.31.0
rapidfort debian 12node-axios0:1.15.0-1
rapidfort debian 13node-axios0:1.15.0-1
rapidfort fedora 43nextcloud, nextcloud-httpd, nextcloud-mysql ve 16 tane daha33.0.3-1.fc43 ve 1 tane daha
23 kaynaktaki 106 kaydın hepsini göster
KaynakPaketDüzeltildiği sürüm
chainguardarangodb-3.113.11.14.5-r14
chainguardawx24.6.1-r42
chainguardgitlab-rails-ce-18.1118.11.13-r0
chainguardgitlab-rails-ce-19.019.0.10-r0
chainguardgitlab-rails-ce-19.119.1.7-r6
chainguardgitlab-rails-ce-19.219.2.5-r2
chainguardgitlab-rails-ce-19.319.3.1-r6
chainguardgitlab-rails-ce-fips-18.1018.10.8-r8
chainguardgitlab-rails-ce-fips-18.1118.11.12-r2
chainguardgitlab-rails-ce-fips-18.918.9.8-r8
chainguardgitlab-rails-ce-fips-19.019.0.9-r3
chainguardgitlab-rails-ce-fips-19.119.1.7-r7
chainguardgitlab-rails-ce-fips-19.219.2.5-r2
chainguardgitlab-rails-ce-fips-19.319.3.1-r3
chainguardjitsucom-jitsu2.11.0-r21
chainguardkibana-8.178.17.10-r17
chainguardkibana-8.198.19.14-r2
chainguardkibana-9.09.0.8-r19
chainguardkibana-9.19.1.10-r12
chainguardkibana-9.29.2.7-r5
chainguardkibana-9.39.3.3-r4
chainguardkubeflow-centraldashboard1.10.0-r19
chainguardkubeflow-katib0.19.0-r40
chainguardkubeflow-pipelines2.16.0-r13
chainguardlangfuse-22.95.12-r19
chainguardlangfuse-33.164.0-r5
chainguardlangfuse-fips-22.95.12-r22
chainguardlangfuse-fips-33.164.0-r3
chainguardlerna9.0.7-r3
chainguardlibrechat0.8.4-r5
chainguardnextcloud-server-3131.0.14-r5
chainguardnextcloud-server-3333.0.6-r0
chainguardopensearch-dashboards-22.19.5-r8
chainguardopensearch-dashboards-2-fips2.19.5-r7
chainguardopensearch-dashboards-33.5.0-r15
chainguardopensearch-dashboards-3-fips3.5.0-r10
chainguardprism5.15.6-r2
chainguardredisinsight3.2.0-r5
chainguardsaf1.6.0-r0
chainguardwazuh-dashboard4.14.4-r2
debian 11node-axiosdüzeltme belirtilmemiş
debian 12node-axiosdüzeltme belirtilmemiş
debian 13node-axiosdüzeltme belirtilmemiş
debian 14node-axios1.15.0-1
echonode-axiosdüzeltme belirtilmemiş
echo npm::Echo OSVaxios1.14.0+echo.1
minimoscube-1.71.7.36-r0
minimoskibana-8.198.19.15-r0
minimoskibana-9.39.3.4-r0
minimoskubeflow-pipelines-frontend2.17.0-r0
minimosopenclaw2026.4.15-r0
minimosopensearch-dashboards-22.19.6-r0
minimosopensearch-dashboards-fips-22.19.6-r0
npm::GitHub Security Advisory npmaxios1.15.0, 0.31.0
rapidfort debian 12node-axios0:1.15.0-1
rapidfort debian 13node-axios0:1.15.0-1
rapidfort fedora 43nextcloud33.0.3-1.fc43
rapidfort fedora 43nextcloud-httpd33.0.3-1.fc43
rapidfort fedora 43nextcloud-mysql33.0.3-1.fc43
rapidfort fedora 43nextcloud-nginx33.0.3-1.fc43
rapidfort fedora 43nextcloud-postgresql33.0.3-1.fc43
rapidfort fedora 43nextcloud-sqlite33.0.3-1.fc43
rapidfort fedora 43pgadmin49.14-3.fc43
rapidfort fedora 43pgadmin4-doc9.14-3.fc43
rapidfort fedora 43pgadmin4-httpd9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-cs9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-de9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-es9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-fr9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-it9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-ja9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-ko9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-pl9.14-3.fc43
rapidfort fedora 43pgadmin4-langpack-ru9.14-3.fc43
rapidfort fedora 43pgadmin4-qt9.14-3.fc43
rapidfort Oracle Linux 10nextcloud33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-httpd33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-mysql33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-nginx33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-postgresql33.0.3-1.el10_3
rapidfort Oracle Linux 10nextcloud-sqlite33.0.3-1.el10_3
rapidfort ubuntu 20.04node-axios0:1.16.0-1
rapidfort ubuntu 22.04node-axios0:1.16.0-1
rapidfort ubuntu 24.04node-axios0:1.16.0-1
Red Hatopenshift3/ose-consoledüzeltme belirtilmemiş
Red Hatopenshift4/ose-consoledüzeltme belirtilmemiş
Red Hatredhat-user-workloads/iop-advisor-frontend-sat-6-18düzeltme belirtilmemiş
Red Hatredhat-user-workloads/iop-host-inventory-frontend-sat-6-18düzeltme belirtilmemiş
Red Hatredhat-user-workloads/kiali-2-6düzeltme belirtilmemiş
Red Hatredhat-user-workloads/kiali-2-6-ossmcdüzeltme belirtilmemiş
seal npm::Seal Security Database@seal-security/axios0.21.1-sp999, 0.21.4-sp5, 0.26.1-sp999, 0.27.2-sp5, 1.11.0-sp999, 1.12.0-sp999, 1.12.2-sp999, 1.13.2-sp999, 1.3.6-sp999, 1.4.0-sp999, 1.5.0-sp999, 1.5.1-sp999, 1.6.0-sp5, 1.6.7-sp999, 1.6.8-sp999, 1.7.1-sp999, 1.7.2-sp2, 1.7.3-sp999, 1.7.9-sp2, 1.8.1-sp999, 1.8.3-sp2, 1.8.4-sp2
seal npm::Seal Security Databaseaxios0.21.1-sp999, 0.21.4-sp5, 0.26.1-sp999, 0.27.2-sp5, 1.11.0-sp999, 1.12.0-sp999, 1.12.2-sp999, 1.13.2-sp999, 1.3.6-sp999, 1.4.0-sp999, 1.5.0-sp999, 1.5.1-sp999, 1.6.0-sp5, 1.6.7-sp999, 1.6.8-sp999, 1.7.1-sp999, 1.7.2-sp2, 1.7.3-sp999, 1.7.9-sp2, 1.8.1-sp999, 1.8.3-sp2, 1.8.4-sp2
ubuntu 20.04-ESMnode-axios0.19.0+dfsg-2ubuntu0.1~esm1
ubuntu 22.04node-axiosdüzeltme belirtilmemiş
ubuntu 24.04node-axiosdüzeltme belirtilmemiş
ubuntu 26.04node-axiosdüzeltme belirtilmemiş
wolfijitsucom-jitsu2.11.0-r21
wolfikubeflow-centraldashboard1.10.0-r19
wolfikubeflow-katib0.19.0-r40
wolfikubeflow-pipelines2.16.0-r13
wolfilangfuse-33.164.0-r5
wolfilerna9.0.7-r3
wolfinextcloud-server-3333.0.6-r0
wolfiopensearch-dashboards-33.5.0-r15
wolfiprism5.15.6-r2
wolfisaf1.6.0-r0

Referanslar

50 referansın hepsi

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.