Skip to content

Commit 38798b9

Browse files
fix(security): update axios to ^1.15.0 to fix SSRF via NO_PROXY bypass [APS-18718]
- Bump axios from ^1.7.7 to ^1.15.0 - Fixes CVE-2025-62718 / GHSA-3p68-rc4w-qgx5 - Axios did not normalize hostnames when checking NO_PROXY rules, allowing requests to loopback addresses (localhost., [::1]) to bypass NO_PROXY and go through the configured proxy (SSRF risk) Resolves: APS-18718
1 parent 375f60f commit 38798b9

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

package.json

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
"dependencies": {
1515
"archiver": "5.3.0",
1616
"async": "3.2.3",
17-
"axios": "^1.7.7",
17+
"axios": "^1.15.0",
1818
"axios-retry": "^3.5.0",
1919
"browserstack-local": "^1.5.12",
2020
"chalk": "4.1.2",

0 commit comments

Comments
 (0)