GHSA-f4gw-2p7v-4548

## Summary Axios versions containing `lib/helpers/shouldBypassProxy.js` do not treat `0.0.0.0` as a local address when evaluating `NO_PROXY` rules. In Node.js applications that use `HTTP_PROXY` or `HTTPS_PROXY` together with `NO_PROXY=localhost,127.0.0.1,::1` or similar, a request to `http://0.0.0.0:<port>/` can be routed through the configured proxy instead of bypassing it. The issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when the proxy can reach or relay `0.0.0.0` to local services. This is a Node.js runtime proxy-routing issue, not a browser, install-time, or development-tooling issue. ## Impact Applications are affected when all of the following are true: - The application runs axios in Node.js with the HTTP adapter. - The process uses environment proxy variables such as `HTTP_PROXY` or `HTTPS_PROXY`. - The process uses `NO_PROXY` entries such as `localhost`, `127.0.0.1`, or `::1` to keep local traffic out of the proxy path. - Attacker-controlled input can influence the request URL or redirect target. - The configured proxy does not reject `0.0.0.0` and can reach the local destination. For plain HTTP targets, the proxy can receive the full request URL, headers, and body, and may be able to observe the local service response. HTTPS targets are less exposed because axios uses CONNECT tunneling in current versions. ## Affected Functionality Affected functionality is limited to environment-derived proxy selection in the Node HTTP adapter: - `lib/adapters/http.js` calls `getProxyForUrl(location)` and then `shouldBypassProxy(location)` before applying the proxy. - `lib/helpers/shouldBypassProxy.js` normalizes and compares `NO_PROXY` entries. - Explicit caller-provided `config.proxy` remains trusted caller configuration. - Browser, React Native, XHR, and fetch adapter behavior are not affected. ## Technical Details `lib/helpers/shouldBypassProxy.js` defines local loopback equivalence through `is