Skip to main content

Axios CVE-2026-42043

| EUVDEUVD-2026-25608 CRITICAL
Permissive List of Allowed Inputs (CWE-183)
2026-04-24 GitHub_M GHSA-pmwg-cvhr-8vh7
Node.js Authentication Bypass Axios
10.0
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
vuln.today AI
5.4 MEDIUM

Network-reachable but requires attacker-influenced URL plus a NO_PROXY-dependent proxy config (AC:H); scope changes as traffic is misrouted to a proxy, with partial confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE
7.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Red Hat
7.2 HIGH
qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

14
Analysis Updated
Jun 30, 2026 - 03:45 vuln.today
v5 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 03:43 vuln.today
v4 (cvss_changed)
Source Code Evidence Fetched
Jun 30, 2026 - 03:43 vuln.today
Analysis Updated
Jun 30, 2026 - 03:43 vuln.today
v3 (cvss_changed)
Analysis Updated
Jun 30, 2026 - 03:42 vuln.today
v2 (cvss_changed)
Severity Changed
Jun 30, 2026 - 03:24 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.2 (HIGH) 10.0 (CRITICAL)
Patch released
Apr 27, 2026 - 20:05 nvd
Patch available
Re-analysis Queued
Apr 27, 2026 - 14:22 vuln.today
cvss_changed
Patch available
Apr 24, 2026 - 20:17 EUVD
Analysis Generated
Apr 24, 2026 - 18:45 vuln.today
EUVD ID Assigned
Apr 24, 2026 - 18:15 euvd
EUVD-2026-25608
Analysis Generated
Apr 24, 2026 - 18:15 vuln.today
CVE Published
Apr 24, 2026 - 17:54 nvd
HIGH 7.2

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

DescriptionNVD

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

Articles & Coverage 1

infosecwriteups.com CVE-2026-42043: Axios v1.15.0 NO_PROXY SSRF Patch Bypassed via 127.0.0.0/8 Loopback Range May 29, 2026

AnalysisAI

NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a request's target URL route loopback-bound traffic through an attacker-configured proxy by using any address in the 127.0.0.0/8 range other than 127.0.0.1 (e.g. 127.0.0.2, 127.1.2.3). This is an incomplete fix for CVE-2025-62718: the patch hardcoded only localhost, 127.0.0.1, and ::1 as loopback, ignoring RFC 1122's full /8 loopback block. Publicly available exploit code exists, but no public active exploitation is identified and EPSS is low (0.03%); it is fixed in 1.15.1 and 0.31.1.

Technical ContextAI

Axios is one of the most widely used promise-based HTTP clients for Node.js and browsers. The flaw lives in server-side proxy handling: lib/helpers/shouldBypassProxy.js compares a request hostname against NO_PROXY rules to decide whether to bypass the configured HTTP proxy for internal/loopback destinations. The 1.15.0 remediation of CVE-2025-62718 added normalizeNoProxyHost() and a LOOPBACK_ADDRESSES = new Set(['localhost','127.0.0.1','::1']) allowlist, but RFC 1122 §3.2.1.3 defines the entire 127.0.0.0/8 subnet (127.0.0.2-127.255.255.254) as loopback on Linux, macOS, and Windows/WSL. Because the set recognizes only a single IPv4 loopback literal, any other in-range address fails the NO_PROXY match and is forwarded to the proxy. This maps to CWE-183 (Permissive List of Allowed Inputs) - an incomplete denylist/allowlist that fails to cover the full equivalent input space.

RemediationAI

Vendor-released patch: upgrade to axios 1.15.1 (1.x line) or 0.31.1 (0.x line), both of which extend loopback recognition to the full 127.0.0.0/8 range; note that 1.15.0 is NOT sufficient since it only partially fixed CVE-2025-62718. Rebuild and redeploy any service bundling a vulnerable axios, and for Red Hat platforms apply the relevant errata (e.g. RHSA-2026:17699 and the other listed RHSAs). Where immediate upgrade is impossible, compensating controls: validate and constrain any user-influenced URL before passing it to axios (reject or normalize hosts in 127.0.0.0/8 and other loopback equivalents rather than trusting NO_PROXY), and do not rely on NO_PROXY as a security boundary for protecting internal/loopback services - instead enforce egress controls at the proxy/firewall so the proxy itself refuses to forward to loopback/internal ranges (trade-off: requires proxy ACL changes and may break legitimate internal routing). Advisory: https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7 .

More in Node.js

View all
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2013-4660 MEDIUM POC
6.8 Jun 28

The JS-YAML module before 2.0.5 for Node.js parses input without properly considering the unsafe !!js/function tag, whic
CVE-2015-5688 MEDIUM POC
5.0 Sep 04

Directory traversal vulnerability in lib/app/index.js in Geddy before 13.0.8 for Node.js allows remote attackers to read
CVE-2026-45321 CRITICAL POC
9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
CVE-2014-7192 CRITICAL POC
10.0 Dec 11

Eval injection vulnerability in index.js in the syntax-error package before 1.1.1 for Node.js 0.10.x, as used in IBM Rat
CVE-2013-4450 MEDIUM POC
5.0 Oct 21

The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of se

Same weakness CWE-183 – Permissive List of Allowed Inputs

View all
CVE-2026-29514 HIGH POC
8.7
CVE-2024-38522 MEDIUM POC
6.3
CVE-2026-3490 CRITICAL
10.0
CVE-2026-50189 HIGH
8.9
CVE-2026-46391 HIGH
8.7
CVE-2026-41387 HIGH
8.5
CVE-2026-21915 HIGH
8.4
CVE-2026-40899 HIGH
8.3

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2012-1723 CRITICAL POC
9.8
CVE-2017-10271 HIGH POC
7.5
CVE-2015-1427 CRITICAL POC
9.8
CVE-2025-3248 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-42043 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy