CVE-2026-42043

HIGH

Axios <1.15.1, <0.31.1 - Auth Bypass

Title source: llm
STIX 2.1

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

References (41)

Core 41
Core References

Scores

CVSS v3 7.2
EPSS 0.0066
EPSS Percentile 48.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-183 CWE-441 CWE-918
Status published
Products (3)
axios/axios < 0.31.1 (2 CPE variants)
axios/axios >= 1.0.0, < 1.15.1
npm/axios 1.0.0 - 1.15.1npm
Published Apr 24, 2026
Tracked Since Apr 24, 2026