CVE-2026-42038 Details
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.
A vulnerability in Axios, a promise-based HTTP client for the browser and Node.js, allows for server-side request forgery (SSRF) by bypassing the no_proxy setting for loopback addresses. This issue is present in versions of Axios prior to 1.15.1 and 0.31.1. The vulnerability arises because the shouldBypassProxy() function only performs string matching and does not account for IP aliases or loopback equivalents. As a result, when no_proxy is set to 'localhost', requests to 127.0.0.1 and [::1] still go through the proxy instead of being bypassed. This can lead to internal data being leaked if an attacker can manipulate the request URL to route through an attacker-controlled proxy.
Users should update to Axios versions 1.15.1 or 0.31.1 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| axios axios | < 0.31.1 >= 1.0.0, < 1.15.1 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 27, 2026 | Initial Analysis | [email protected] |
| Apr 27, 2026 | CVE Modified | CISA-ADP |
| Apr 24, 2026 | New CVE Received | [email protected] |