CVE-2026-42038

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-42038) has been identified in Axios's proxy bypass mechanism. Axios supports the no_proxy setting to allow requests to specified hosts to bypass a configured proxy. However, its hostname-matching logic fails to recognize equivalent loopback addresses, allowing requests to 127.0.0.1 and [::1] to pass through the proxy even when no_proxy=localhost is configured. As a result, requests intended for local services could be routed through an attacker-controlled proxy, potentially exposing sensitive information.

This kind of unintended server-side request routing maps to CWE-918 (Server-Side Request Forgery), where an attacker can influence an application to send requests to an unintended destination. In Axios, incomplete hostname matching allows loopback IP addresses to bypass the intended no_proxy configuration. If an attacker can influence the request URL and the request passes through an attacker-controlled proxy, traffic intended for local services may be exposed, potentially leaking sensitive information.

Details

Module Info

Product: Axios
Affected packages: axios
Affected versions:

• >=1.0.0, <1.15.1
• <0.31.1

GitHub repository: https://github.com/axios/axios
Published packages: https://www.npmjs.com/package/axios
Package manager: npm

• Fixed in:
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This medium-severity vulnerability affects server-side applications using Axios with a configured proxy and no_proxy exclusions. Axios uses these exclusions to send requests to specified hosts directly, bypassing the proxy. However, its proxy bypass logic compares hostname strings without recognizing equivalent loopback addresses. Consequently, setting no_proxy=localhost does not prevent requests to 127.0.0.1 or [::1] from passing through the proxy. The Axios advisory rates this vulnerability as moderate severity, with a CVSS score of 6.8.

When an attacker can influence a request URL, substituting a loopback IP address for localhost can cause traffic intended for a local service to be routed through the configured proxy. If that proxy is attacker-controlled, sensitive request information could be exposed. Exploitation therefore depends on the application's proxy configuration and the attacker's ability to influence request destinations.

This behavior aligns with CWE-918 (Server-Side Request Forgery). This category covers vulnerabilities in which attacker-influenced URLs cause a server to make unintended requests, potentially exposing sensitive information or bypassing network restrictions.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.