CVE-2025-62718 CRITICAL vulnerability in the Axios package

https://nvd.nist.gov/vuln/detail/CVE-2025-62718

**Summary**

There is a critical vulnerability in the Axios package (version 1.13.5) related to hostname normalization when using NO_PROXY rules. This issue may allow attackers to bypass proxy settings, leading to potential SSRF vulnerabilities.

**Context**

Axios is a promise-based HTTP client for the browser and Node.js. The vulnerability was identified in versions prior to 1.15.0, where requests to loopback addresses could bypass NO_PROXY matching.

**Acceptance criteria**

Upgrade Axios to version 1.15.0 or later to resolve the vulnerability.

Ensure that the application correctly handles hostname normalization with NO_PROXY rules.

Validate that requests to loopback addresses do not go through the configured proxy.

**Other information**

Vulnerability ID: CVE-2025-62718

**Affected version:**
--platform=linux/amd64 public.ecr.aws/lambda/nodejs:22