CVE-2026-42043

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-42043) has been identified in Axios's proxy bypass mechanism. Axios supports NO_PROXY exclusions to send requests directly to specified hosts. However, its loopback detection recognizes only localhost, 127.0.0.1, and ::1, overlooking other addresses within 127.0.0.0/8. Requests to addresses such as 127.0.0.2 can therefore pass through the configured proxy despite loopback exclusions, potentially exposing sensitive request information. This is an incomplete fix for CVE-2025-62718.

This unintended request routing maps to CWE-918 (Server-Side Request Forgery), where attacker-influenced URLs cause a server to contact unintended destinations. In Axios, incomplete recognition of the IPv4 loopback range allows crafted URLs to bypass intended NO_PROXY exclusions. Depending on the proxy configuration and accessible services, this could enable unauthorized access or information disclosure.

Details

Module Info

Product: Axios
Affected packages: axios
Affected versions:

• >=1.0.0, <1.15.1
• <0.31.1

GitHub repository: https://github.com/axios/axios
Published packages: https://www.npmjs.com/package/axios
Package manager: npm

• Fixed in:
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1
  • NES for Axios

Vulnerability Info

This high-severity vulnerability affects Node.js applications using Axios with a configured proxy and loopback NO_PROXY exclusions. An incomplete fix for CVE-2025-62718 fails to recognize the full 127.0.0.0/8 loopback range. The Axios advisory assigns a CVSS v3.1 score of 7.2.

An attacker who can influence request destinations can substitute an address such as 127.1.2.3 to cause a request to pass through the configured proxy. If that proxy is attacker-controlled, request information intended to remain local could be exposed. Exploitation depends on attacker influence over the URL and the application's proxy settings.

This behavior aligns with CWE-918 (Server-Side Request Forgery). This category covers insufficient validation of request destinations, potentially allowing attackers to misuse a server's network access. Here, NO_PROXY controls whether requests use a proxy; it does not prohibit requests to the listed hosts.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.