Commit 38798b9
committed
fix(security): update axios to ^1.15.0 to fix SSRF via NO_PROXY bypass [APS-18718]
- Bump axios from ^1.7.7 to ^1.15.0
- Fixes CVE-2025-62718 / GHSA-3p68-rc4w-qgx5
- Axios did not normalize hostnames when checking NO_PROXY rules,
allowing requests to loopback addresses (localhost., [::1]) to
bypass NO_PROXY and go through the configured proxy (SSRF risk)
Resolves: APS-187181 parent 375f60f commit 38798b9
1 file changed
Lines changed: 1 addition & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
14 | 14 | | |
15 | 15 | | |
16 | 16 | | |
17 | | - | |
| 17 | + | |
18 | 18 | | |
19 | 19 | | |
20 | 20 | | |
| |||
0 commit comments