Skip to content

[Aikido] Fix critical issue in axios via minor version upgrade from 1.14.0 to 1.15.0#1644

Merged
TheOrangePuff merged 2 commits intomainfrom
fix/aikido-security-update-packages-22720129-74ds
Apr 14, 2026
Merged

[Aikido] Fix critical issue in axios via minor version upgrade from 1.14.0 to 1.15.0#1644
TheOrangePuff merged 2 commits intomainfrom
fix/aikido-security-update-packages-22720129-74ds

Conversation

@aikido-autofix
Copy link
Copy Markdown
Contributor

Upgrade axios to fix critical proxy bypass and SSRF vulnerabilities in hostname normalization that could allow attackers to reach protected internal services.

✅ There are no breaking changes

✅ 1 CVE resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2025-62718
🚨 CRITICAL
[axios] Axios fails to properly normalize hostnames when checking NO_PROXY rules, allowing requests to loopback addresses (localhost., [::1]) to bypass proxy protections and reach internal services. This enables proxy bypass and SSRF attacks against protected loopback or internal endpoints.

@aikido-autofix aikido-autofix bot requested a review from a team as a code owner April 10, 2026 22:45
@aikido-autofix aikido-autofix bot requested review from NgaNaNa and hubertott April 10, 2026 22:45
@TheOrangePuff TheOrangePuff merged commit 8f37a11 into main Apr 14, 2026
1 check passed
@github-actions github-actions bot mentioned this pull request Apr 2, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant