CVE-2025-62718: Proxy From Env No Proxy Hostname Bypass Ssrf

`getProxyForUrl()` from `proxy-from-env` does not normalize hostnames with trailing dots (e.g., `localhost.`) or IPv6 bracket notation (e.g., `[::1]`). Using its result directly to configure a proxy without an independent no_proxy bypass check allows these non-normalized hostname variants to evade `no_proxy` matching, routing requests through the proxy when

Provally CuratedPublic repositoryHighMedium confidenceVerifiedApache-2.0javascript
greprules fetch cve-2025-62718-proxy-from-env-no-proxy-hostname-bypass-ssrf --engine opengrep

Description

`getProxyForUrl()` from `proxy-from-env` does not normalize hostnames with trailing dots (e.g., `localhost.`) or IPv6 bracket notation (e.g., `[::1]`). Using its result directly to configure a proxy without an independent no_proxy bypass check allows these non-normalized hostname variants to evade `no_proxy` matching, routing requests through the proxy when

Detection target

Not provided

Recommended fix

Not provided

False-positive notes

Not provided

Community feedback

Sign in to report false positives, mark this rule useful, or suggest metadata improvements.