{"action":"Upgrade axios to 0.31.0 or later.","affected":[{"fixed":"1.15.0","introduced":"1.0.0"},{"fixed":"0.31.0","introduced":"0"}],"component":"axios","cve_ids":["CVE-2025-62718"],"ecosystem":"npm","epss":0.01186,"exploited":false,"fixed_versions":["1.15.0","0.31.0"],"ghsa_id":"GHSA-3p68-rc4w-qgx5","id":"tcs_01M5KEXV7JHV63C10ZPPT58J9Q","modified_at":"2026-09-10T03:50:42.452672741Z","published_at":"2026-04-09T17:32:19Z","references":["https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5","https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5","https://nvd.nist.gov/vuln/detail/CVE-2025-62718","https://github.com/axios/axios/pull/10661","https://github.com/axios/axios/pull/10688","https://github.com/axios/axios/commit/03cdfc99e8db32a390e12128208b6778492cee9c","https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df","https://datatracker.ietf.org/doc/html/rfc1034#section-3.1","https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2","https://github.com/axios/axios","https://github.com/axios/axios/releases/tag/v0.31.0","https://github.com/axios/axios/releases/tag/v1.15.0"],"severity":{"label":"medium","score":4.8},"sources":[{"source":"osv","source_id":"GHSA-3p68-rc4w-qgx5","url":"https://osv.dev/vulnerability/GHSA-3p68-rc4w-qgx5"}],"summary":"Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF"}