Skip to main content

Axios EUVDEUVD-2026-25608

| CVE-2026-42043 CRITICAL
Permissive List of Allowed Inputs (CWE-183)
2026-04-24 GitHub_M GHSA-pmwg-cvhr-8vh7
Authentication Bypass Node.js Axios
10.0
CVSS 3.1 · NVD
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Influence Axios request URL
  2. Delivery
    Substitute 127.0.0.1 with 127.0.0.2
  3. Exploit
    NO_PROXY allowlist fails to match
  4. Execution
    Request forwarded to attacker proxy
  5. Impact
    Intercept/redirect loopback-bound traffic

Vulnerability Assessment

Weakness
CWE
CWE-183
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Strict input allowlisting
Exploitation Conditions

Requires three concrete conditions: (1) the application must allow an attacker to influence the target URL of an Axios request (user-supplied URL, redirect-following, or SSRF-adjacent input); (2) the deployment must use a configured HTTP proxy together with NO_PROXY rules intended to keep loopback/internal traffic direct; and (3) the attacker substitutes 127.0.0.1 with any other 127.0.0.0/8 address (127.0.0.2-127.255.255.254, e.g. 127.0.0.2, 127.0.0.100, 127.1.2.3). Limiting factors: it only matters server-side in Node.js where proxy+NO_PROXY is in use; if the app does not expose URL control or does not depend on NO_PROXY as a protection boundary, the flaw is not reachable. The impact is proxy bypass/traffic redirection of loopback-targeted requests, not arbitrary code execution. Affected versions: axios 1.0.0-1.15.0 and ≤0.31.0.
Impact

Signals conflict sharply and warrant judgment beyond the headline number. The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N) yields a 10.0 largely from the scope-change (S:C) and assumed network reach, but the real-world precondition - the application must let an attacker influence the Axios request URL AND be configured to rely on NO_PROXY to shield an internal/loopback service - is significant and not reflected in PR:N. SSVC frames it more soberly: Exploitation=poc (not active), Automatable=yes, Technical Impact=partial. EPSS is very low at 0.03% (8th percentile), and it is not in CISA KEV, so this reads as a real-but-conditional weakness rather than a mass-exploited emergency. POC availability raises the floor for opportunistic abuse in SSRF/proxy-confusion chains, but the practical impact is exposure of traffic intended to stay local to a malicious proxy (confidentiality/integrity of forwarded requests), not direct RCE. Net: patch promptly given Axios's ubiquity and CVSS, but treat the 10.0 as inflated relative to the conditional trigger and low EPSS.
Exploit ScenarioDerived

An application uses axios for outbound calls with NO_PROXY=localhost,127.0.0.1,::1 set to keep requests to a local admin/metadata service from traversing the corporate proxy, and exposes a feature where a user supplies or influences the destination URL. The attacker submits a URL targeting 127.0.0.2 (or 127.1.2.3); because the patched 1.15.0 allowlist doesn't recognize it as loopback, axios forwards the request through the attacker-influenced/configured proxy instead of going direct, exposing or manipulating the intended-local traffic. A public PoC (https://gist.github.com/alon710/1fe74fd0f0234822bdcb48ade706690f) demonstrates the bypass on axios 1.15.0 / Node v22.16.0.
Act Now Prioritize within 24-48h. Why: CRITICAL severity + public POC available.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv5 – Jun 30, 2026

NO_PROXY protection bypass in Axios HTTP client (versions 1.0.0-1.15.0 and ≤0.31.0) lets an attacker who controls a request's target URL route loopback-bound traffic through an attacker-configured proxy by using any address in the 127.0.0.0/8 range other than 127.0.0.1 (e.g. 127.0.0.2, 127.1.2.3). This is an incomplete fix for CVE-2025-62718: the patch hardcoded only localhost, 127.0.0.1, and ::1 as loopback, ignoring RFC 1122's full /8 loopback block. Publicly available exploit code exists, but no public active exploitation is identified and EPSS is low (0.03%); it is fixed in 1.15.1 and 0.31.1.

Earlier versions of this analysis (4)
v4 Jun 30, 2026 - 03:43 cvss changed CVSS 10.0

NO_PROXY bypass in the Axios HTTP client (versions 1.0.0 through <1.15.1 and <0.31.1) lets an attacker who can influence a request's target URL route traffic to any address in 127.0.0.0/8 except 127.0.0.1, defeating proxy/loopback restrictions. It is an incomplete fix for CVE-2025-62718 and is tagged as an authentication/proxy-control bypass. Publicly available exploit code exists, though EPSS is very low (0.03%, 8th percentile) and the issue is not on CISA KEV; SSVC rates exploitation as PoC with partial technical impact.

v3 Jun 30, 2026 - 03:43 cvss changed CVSS 10.0

NO_PROXY protection bypass in the Axios HTTP client (npm package axios) for Node.js and the browser allows an attacker who can influence a request's target URL to reach loopback services by substituting any address in the 127.0.0.0/8 range (e.g. 127.0.0.2, 127.1.2.3) other than 127.0.0.1, defeating proxy-egress controls that developers rely on to protect internal/loopback endpoints. The flaw is an incomplete fix for CVE-2025-62718: the 1.15.0 patch only normalized 'localhost', '127.0.0.1' and '::1', leaving the rest of the RFC 1122 loopback subnet unguarded. Publicly available exploit code exists and the issue is fixed in 1.15.1 and 0.31.1, though EPSS is very low (0.03%) and it is not on CISA KEV.

v2 Jun 30, 2026 - 03:42 cvss changed CVSS 10.0

NO_PROXY bypass in Axios before 1.15.1 (and 0.x before 0.31.1) lets an attacker who can influence a request's target URL reach any address in 127.0.0.0/8 other than 127.0.0.1, defeating proxy-based egress controls and enabling SSRF-style access to loopback services. The flaw is an incomplete fix for CVE-2025-62718, where the prior patch only accounted for 127.0.0.1. Publicly available exploit code exists (PoC gist), but EPSS is very low (0.03%, 8th percentile) and the issue is not in CISA KEV, so widespread exploitation is not indicated.

v1 Apr 24, 2026 - 18:45 CVSS 7.2

HTTP request smuggling in Axios HTTP client library allows remote attackers to bypass NO_PROXY protection and route requests through 127.0.0.0/8 addresses other than 127.0.0.1. Attackers who control target URLs in applications using Axios prior to versions 1.15.1 and 0.31.1 can bypass proxy restrictions and potentially access internal resources with changed scope (CVSS S:C). This is an incomplete fix regression of CVE-2025-62718, indicating the original patch failed to cover the full 127.0.0.0/8 loopback range. No public exploit identified at time of analysis, EPSS data not provided.

RemediationAI

Vendor-released patch: upgrade to axios 1.15.1 (1.x line) or 0.31.1 (0.x line), both of which extend loopback recognition to the full 127.0.0.0/8 range; note that 1.15.0 is NOT sufficient since it only partially fixed CVE-2025-62718. Rebuild and redeploy any service bundling a vulnerable axios, and for Red Hat platforms apply the relevant errata (e.g. RHSA-2026:17699 and the other listed RHSAs). Where immediate upgrade is impossible, compensating controls: validate and constrain any user-influenced URL before passing it to axios (reject or normalize hosts in 127.0.0.0/8 and other loopback equivalents rather than trusting NO_PROXY), and do not rely on NO_PROXY as a security boundary for protecting internal/loopback services - instead enforce egress controls at the proxy/firewall so the proxy itself refuses to forward to loopback/internal ranges (trade-off: requires proxy ACL changes and may break legitimate internal routing). Advisory: https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7 .

Affected VersionsENISA

axios 1.0.0, < 1.15.1
axios < 0.31.1

Affected Packages

npm axios fix: 0.31.1, 1.15.1

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Axios is one of the most widely used promise-based HTTP clients for Node.js and browsers. The flaw lives in server-side proxy handling: lib/helpers/shouldBypassProxy.js compares a request hostname against NO_PROXY rules to decide whether to bypass the configured HTTP proxy for internal/loopback destinations. The 1.15.0 remediation of CVE-2025-62718 added normalizeNoProxyHost() and a LOOPBACK_ADDRESSES = new Set(['localhost','127.0.0.1','::1']) allowlist, but RFC 1122 §3.2.1.3 defines the entire 127.0.0.0/8 subnet (127.0.0.2-127.255.255.254) as loopback on Linux, macOS, and Windows/WSL. Because the set recognizes only a single IPv4 loopback literal, any other in-range address fails the NO_PROXY match and is forwarded to the proxy. This maps to CWE-183 (Permissive List of Allowed Inputs) - an incomplete denylist/allowlist that fails to cover the full equivalent input space.

Know when Axios gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

NVD PRIMARY 10.0 CRITICAL
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
vuln.today AI 5.4 MEDIUM

Network-reachable but requires attacker-influenced URL plus a NO_PROXY-dependent proxy config (AC:H); scope changes as traffic is misrouted to a proxy, with partial confidentiality/integrity impact and no availability effect.

3.1 AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N
SUSE 7.2 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Red Hat 7.2 HIGH

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Severity Changed
Jun 30, 2026 - 03:24 NVD
HIGH CRITICAL
CVSS changed
Jun 30, 2026 - 03:24 NVD
7.2 (HIGH) 10.0 (CRITICAL)
Patch released
Apr 27, 2026 - 20:05 nvd
Patch available
Patch available
Apr 24, 2026 - 20:17 EUVD
CVE Published
Apr 24, 2026 - 17:54 nvd
HIGH 7.2

DescriptionNVD

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 273 npm packages depend on axios (189 direct, 84 indirect)

Ecosystem-wide dependent count for version 1.0.0.

Articles & Coverage 1

infosecwriteups.com CVE-2026-42043: Axios v1.15.0 NO_PROXY SSRF Patch Bypassed via 127.0.0.0/8 Loopback Range May 29, 2026

Executive ViewAI

Why It Matters

Axios HTTP client versions 1.0.0-1.15.0 and ≤0.31.0 contain a critical proxy bypass vulnerability that could allow attackers to circumvent network security controls and gain unauthorized access to internal systems and infrastructure. Organizations using affected versions must immediately patch to version 1.15.1 or 0.31.1 to restore proxy protection. This vulnerability undermines the network security architecture that many organizations depend on to isolate and protect sensitive internal services.

Business Impact: High
Compensating Controls

Apply vendor patch. Update Axios to version 1.15.1 or 0.31.1 depending on the major version in use. As interim mitigations pending patch deployment, implement network-level egress controls to restrict loopback traffic and monitor proxy logs for anomalous routing of 127.0.0.0/8 address ranges.

Threat Intelligence Overview

EPSS Score
0.0%
Top 92% exploitable
Prevalence
Ubiquitous
axios is among the most-downloaded npm HTTP clients, embedded everywhere
Threat Intel
1
1 source
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity CRITICAL
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
CRITICAL severity + public POC available
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

70
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +50
PoC: +20
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Authentication Bypass CRITICAL

Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.

More in Axios

View all
CVE-2026-42044 CRITICAL POC
9.1 Apr 24

JSON response tampering in the Axios HTTP client (versions 1.0.0 up to but not including 1.15.2) lets an attacker who ca
CVE-2026-67320 HIGH POC
8.3 Aug 01

Prototype pollution via the Node.js HTTP adapter in axios allows an attacker who controls `Object.prototype.proxy` to si
CVE-2025-27152 HIGH POC
7.7 Mar 07

axios is a promise based HTTP client for the browser and node.js. Rated high severity (CVSS 7.7), this vulnerability is

CVE-2025-58754 HIGH POC
7.5 Sep 12

Axios is a promise based HTTP client for the browser and Node.js. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2026-25639 HIGH POC
7.5 Feb 09

Axios versions up to 0.30.3 is affected by improper check for unusual or exceptional conditions (CVSS 7.5).
CVE-2024-39338 HIGH POC
7.5 Aug 12

axios 1.7.2 allows SSRF via unexpected behavior where requests for path relative URLs get processed as protocol relative
CVE-2021-3749 HIGH POC
7.5 Aug 31

axios is vulnerable to Inefficient Regular Expression Complexity. Rated high severity (CVSS 7.5), this vulnerability is

CVE-2019-10742 HIGH POC
7.5 May 07

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to acce
CVE-2026-42033 HIGH POC
7.4 Apr 24

Prototype pollution in Axios HTTP client versions before 1.15.1 and 0.31.1 enables silent interception and modification

CVE-2026-42039 MEDIUM POC
6.9 Apr 24

Denial of service in Axios HTTP client before versions 1.15.1 and 0.31.1 allows remote unauthenticated attackers to cras
CVE-2026-42041 MEDIUM POC
6.5 Apr 24

Prototype pollution in Axios library versions prior to 1.15.1 and 0.31.1 allows remote attackers to suppress HTTP error

CVE-2023-45857 MEDIUM POC
6.5 Nov 08

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it i

Same weakness CWE-183 – Permissive List of Allowed Inputs

View all
CVE-2026-29514 HIGH POC
8.7
CVE-2026-67345 HIGH POC
8.5
CVE-2024-38522 MEDIUM POC
6.3
CVE-2026-3490 CRITICAL POC
10.0
CVE-2026-66005 MEDIUM POC
5.3
CVE-2026-50189 HIGH
8.9
CVE-2026-46391 HIGH
8.7
CVE-2026-41387 HIGH
8.5

Same technique Authentication Bypass

View all
CVE-2015-3306 CRITICAL POC
10.0
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 12 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://access.redhat.com/errata/RHSA-2026:14937 ADVISORY https://access.redhat.com/errata/RHSA-2026:16476 ADVISORY https://access.redhat.com/errata/RHSA-2026:16532 ADVISORY https://access.redhat.com/errata/RHSA-2026:16534 ADVISORY https://access.redhat.com/errata/RHSA-2026:16535 ADVISORY https://access.redhat.com/errata/RHSA-2026:16542 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-42043 ADVISORY https://ubuntu.com/security/notices/USN-8638-1 ADVISORY https://vuldb.com/vuln/359515 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-42043 REF https://access.redhat.com/errata/RHSA-2026:16874 REF https://access.redhat.com/errata/RHSA-2026:17468 REF https://access.redhat.com/errata/RHSA-2026:17474 REF https://access.redhat.com/errata/RHSA-2026:17657 REF https://access.redhat.com/errata/RHSA-2026:17699 REF https://access.redhat.com/errata/RHSA-2026:19109 REF https://access.redhat.com/errata/RHSA-2026:19375 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:21017 REF https://access.redhat.com/errata/RHSA-2026:21338 REF https://access.redhat.com/errata/RHSA-2026:21772 REF https://access.redhat.com/errata/RHSA-2026:22465 REF https://access.redhat.com/errata/RHSA-2026:22619 REF https://access.redhat.com/errata/RHSA-2026:22629 REF https://access.redhat.com/errata/RHSA-2026:22840 REF https://access.redhat.com/errata/RHSA-2026:23361 REF https://access.redhat.com/errata/RHSA-2026:24536 REF https://access.redhat.com/errata/RHSA-2026:24539 REF https://access.redhat.com/errata/RHSA-2026:24853 REF https://access.redhat.com/errata/RHSA-2026:24977 REF https://access.redhat.com/errata/RHSA-2026:25041 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:25271 REF https://access.redhat.com/errata/RHSA-2026:25273 REF https://access.redhat.com/errata/RHSA-2026:26214 REF https://access.redhat.com/errata/RHSA-2026:26225 REF https://access.redhat.com/errata/RHSA-2026:26232 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:48670 REF https://access.redhat.com/security/cve/CVE-2026-42043 REF https://bugzilla.redhat.com/show_bug.cgi?id=2461626 REF https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42043.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy