https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 18:51:37 +0000 https://vulnerability.circl.lu/vuln/ghsa-44g4-m2mj-wpvx <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.</p> <p>This affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure.</p> <p>## Impact</p> <p>If the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid.</p> <p>This is a proxy exclusion bypass, not arbitrary proxy injection by itself.</p> <p>## Affected Functionality</p> <p>Affected:</p> <p>- Node.js adapter proxy environment handling. - `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents. - CIDR entries in `NO_PROXY`.</p> <p>Not affected:</p> <p>- Exact host or exact IP `NO_PROXY` entries where axios matching succeeds. - Requests configured with `proxy: false`. - Browser adapters.</p> <p>## Technical Details</p> <p>`lib/helpers/shouldBypassProxy.js` parses each `NO_PROXY` entry into a host and optional port, normalizes hostnames, and then compares exact hostnames, suffix entries, wildcard-prefix…</p> <p><strong>Affected:</strong> npm: axios</p> <p>## Summary</p> <p>Axios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.</p> <p>This affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure.</p> <p>## Impact</p> <p>If the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid.</p> <p>This is a proxy exclusion bypass, not arbitrary proxy injection by itself.</p> <p>## Affected Functionality</p> <p>Affected:</p> <p>- Node.js adapter proxy environment handling. - `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents. - CIDR entries in `NO_PROXY`.</p> <p>Not affected:</p> <p>- Exact host or exact IP `NO_PROXY` entries where axios matching succeeds. - Requests configured with `proxy: false`. - Browser adapters.</p> <p>## Technical Details</p> <p>`lib/helpers/shouldBypassProxy.js` parses each `NO_PROXY` entry into a host and optional port, normalizes hostnames, and then compares exact hostnames, suffix entries, wildcard-prefix…</p> https://vulnerability.circl.lu/vuln/ghsa-44g4-m2mj-wpvx