CVE-2025-62718: Proxy From Env No Proxy Hostname Bypass Ssrf
`getProxyForUrl()` from `proxy-from-env` does not normalize hostnames with trailing dots (e.g., `localhost.`) or IPv6 bracket notation (e.g., `[::1]`). Using its result directly to configure a proxy without an independent no_proxy bypass check allows these non-normalized hostname variants to evade `no_proxy` matching, routing requests through the proxy when
greprules fetch cve-2025-62718-proxy-from-env-no-proxy-hostname-bypass-ssrf --engine opengrepDescription
`getProxyForUrl()` from `proxy-from-env` does not normalize hostnames with trailing dots (e.g., `localhost.`) or IPv6 bracket notation (e.g., `[::1]`). Using its result directly to configure a proxy without an independent no_proxy bypass check allows these non-normalized hostname variants to evade `no_proxy` matching, routing requests through the proxy when
Detection target
Not provided
Recommended fix
Not provided
False-positive notes
Not provided
Community feedback
Sign in to report false positives, mark this rule useful, or suggest metadata improvements.