Axios HTTP client CVE-2026-42038

Exploitation requires that Axios be configured with a no_proxy setting that explicitly lists localhost or local hostnames (e.g., no_proxy=localhost or no_proxy=127.0.0.1,localhost). The target application must make HTTP requests to IPv4 loopback (127.0.0.1) or IPv6 loopback ([::1]) addresses rather than using the string 'localhost'. A proxy server must be configured upstream of the Axios client (via http_proxy, https_proxy, or equivalent environment variables or explicit proxy configuration in Axios options). The attacker must have network visibility into proxy traffic, proxy logs, or control over the proxy itself to observe or intercept the unintended proxy-routed request. Exploitation does not require authentication to the target Axios application or the proxy. The vulnerability does not affect configurations where no proxy is set, where no_proxy includes explicit IP address patterns that match the loopback addresses, or where the application explicitly requests localhost by hostname rather than IP address.

This vulnerability presents moderate-to-high risk despite the 6.8 CVSS score because it combines a network-exploitable attack vector (AV:N) with high confidentiality impact (C:H) but elevated attack complexity (AC:H). The AC:H and changed scope (S:C) elements suggest the exploit requires specific deployment conditions-likely a proxy configuration where the attacker controls or can observe proxy behavior-but once exploitation conditions are met, sensitive data exposure is possible. The SSRF nature (CWE-918) indicates attackers could leverage this to access internal services that trust loopback traffic, bypass authentication mechanisms that rely on IP-based filtering, or exfiltrate data through proxy logs. No KEV status, EPSS score, or public exploit details were provided in the intelligence data. The vulnerability is patched in released versions (1.15.1 and 0.31.1), reducing urgency for organizations on patching cycles but requiring immediate action for applications with strict no_proxy security policies. Risk is elevated for deployments using Axios in proxy-aware environments (corporate proxies, security appliances, API gateways) where proxy bypass is a security control rather than a convenience feature.

An attacker in a network environment where a corporate or ISP proxy is configured targets an organization using Axios with no_proxy=localhost. The attacker crafts a request to 127.0.0.1 or [::1] (e.g., an internal admin API or metadata service on the loopback interface) expecting the request to bypass the proxy due to the no_proxy setting. Instead, the request routes through the proxy unintentionally, allowing the attacker to intercept, log, or replay the request if they have visibility into the proxy, or to use the proxy as a pivot point to access internal services that should have been protected by the no_proxy bypass.