Skip to content

chore: update axios to ^1.15.0#5514

Open
krunalg wants to merge 1 commit intocodeceptjs:3.xfrom
krunalg:chore/update-axios-dep
Open

chore: update axios to ^1.15.0#5514
krunalg wants to merge 1 commit intocodeceptjs:3.xfrom
krunalg:chore/update-axios-dep

Conversation

@krunalg
Copy link
Copy Markdown

@krunalg krunalg commented Apr 10, 2026

Motivation/Description of the PR

Security Fix: Axios NO_PROXY Bypass → SSRF Risk

This PR addresses a known vulnerability in Axios where hostname normalization is not handled correctly during NO_PROXY evaluation.

Issue

Axios performs a literal string comparison when matching NO_PROXY rules, without normalizing hostnames.
This allows specially crafted hostnames such as:

  • localhost. (trailing dot)
  • [::1] (IPv6 literal)

to bypass NO_PROXY rules and be routed through a configured proxy.

Impact

  • Enables proxy bypass
  • Leads to potential Server-Side Request Forgery (SSRF)
  • Allows access to loopback/internal services despite protections

This breaks expected behavior where localhost, 127.0.0.1, and ::1 should always bypass proxies.

Root Cause

Per RFC standards, hostnames like localhost. are equivalent to localhost, but Axios does not normalize them before comparison, resulting in incorrect proxy routing.

Resolution

  • Upgrade Axios to a patched version (≥ 1.15.0)
  • Ensures proper hostname normalization before NO_PROXY matching

References


Summary: Fixes a critical SSRF vector caused by improper NO_PROXY handling in Axios by upgrading to a secure version.

Applicable helpers:

  • Playwright
  • Puppeteer
  • WebDriver
  • REST
  • FileHelper
  • Appium
  • TestCafe

Applicable plugins:

  • allure
  • autoDelay
  • autoLogin
  • customLocator
  • pauseOnFail
  • coverage
  • retryFailedStep
  • screenshotOnFail
  • selenoid
  • stepByStepReport
  • stepTimeout
  • wdio
  • subtitles

Type of change

  • 🔥 Breaking changes
  • 🚀 New functionality
  • 🐛 Bug fix
  • 🧹 Chore
  • 📋 Documentation changes/updates
  • ♨️ Hot fix
  • 🔨 Markdown files fix - not related to source code
  • 💅 Polish code

Checklist:

  • Tests have been added
  • Documentation has been added (Run npm run docs)
  • Lint checking (Run npm run lint)
  • Local tests are passed (Run npm test)

@krunalg
Copy link
Copy Markdown
Author

krunalg commented Apr 10, 2026

@DavertMik could you review this PR? I am not able to assign reviewers to it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant