GHSA-f4gw-2p7v-4548: Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

Summary Axios versions containing lib/helpers/shouldBypassProxy.js do not treat 0.0.0.0 as a local address when evaluating NO_PROXY rules. In Node.js applications that use HTTP_PROXY or HTTPS_PROXY together with NO_PROXY=localhost,127.0.0.1,::1 or similar, a request to http://0.0.0.0:<port>/ can be routed through the configured proxy instead of bypassing it. The issue is exploitable when an attacker can influence the axios request URL or a followed redirect target, and when the proxy can reach or relay 0.0.0.0 to local services. This is a Node.js runtime proxy-routing issue, not a browser, install-time, or development-tooling issue. Impact Applications are affected when all of the following are true: - The application runs axios in Node.js with the HTTP adapter. - The process uses environment proxy variables such as HTTP_PROXY or HTTPS_PROXY. - The process uses NO_PROXY entries such as localhost, 127.0.0.1, or ::1 to keep local traffic out of the proxy path. - Attacker-controlled input can influence the request URL or redirect target. - The configured proxy does not reject 0.0.0.0 and can reach the local destination. For plain HTTP targets, the proxy can receive the full request URL, headers, and body, and may be able to observe the local service response. HTTPS targets are less exposed because axios uses CONNECT tunneling in current versions. Affected Functionality Affected functionality is limited to environment-derived proxy selection in the Node HTTP adapter: - lib/adapters/http.js calls getProxyForUrl(location) and then shouldBypassProxy(location) before applying the proxy. - lib/helpers/shouldBypassProxy.js normalizes and compares NO_PROXY entries. - Explicit caller-provided config.proxy remains trusted caller configuration. - Browser, React Native, XHR, and fetch adapter behavior are not affected. Technical Details lib/helpers/shouldBypassProxy.js defines local loopback equivalence through isLoopback(). The current implementation recognizes localho