CVE Feed

    Dashboard / CVE / CVE-2026-42043

    CVE-2026-42043

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

    Published:Apr 24, 2026
    Last Modified:Apr 28, 2026
    EPS:Apr 24, 2026
    EPSS Score:0.00044
    CVSS Score:7.2

    Affected Products

    Vendor
    Axios
    Product
    Axios

    Exploits

    https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7

    Related CVEs

    CVE-2026-67321 (CVSS 6.9) — axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFor…
    CVE-2026-67318 (CVSS 6.3) — axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed …
    CVE-2026-67319 (CVSS 6.3) — axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option object…
    CVE-2026-67312 (CVSS 6.3) — axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDa…
    CVE-2026-67315 (CVSS 6.9) — axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address i…
    CVE-2026-67316 (CVSS 6.3) — axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.p…
    CVE-2026-67320 (CVSS 8.3) — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. …
    CVE-2026-67313 (CVSS 6.3) — axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData fiel…
    CVE-2026-67314 (CVSS 6.3) — axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handl…
    CVE-2026-67317 (CVSS 6.3) — axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in t…

    References

    https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
    https://access.redhat.com/errata/RHSA-2026:14937
    https://access.redhat.com/errata/RHSA-2026:16476
    https://access.redhat.com/errata/RHSA-2026:16532
    https://access.redhat.com/errata/RHSA-2026:16534
    https://access.redhat.com/errata/RHSA-2026:16535
    https://access.redhat.com/errata/RHSA-2026:16542
    https://access.redhat.com/errata/RHSA-2026:16874
    https://access.redhat.com/errata/RHSA-2026:17468
    https://access.redhat.com/errata/RHSA-2026:17474
    https://access.redhat.com/errata/RHSA-2026:17657
    https://access.redhat.com/errata/RHSA-2026:17699
    https://access.redhat.com/errata/RHSA-2026:19109
    https://access.redhat.com/errata/RHSA-2026:19375
    https://access.redhat.com/errata/RHSA-2026:20889
    https://access.redhat.com/errata/RHSA-2026:20938
    https://access.redhat.com/errata/RHSA-2026:21017
    https://access.redhat.com/errata/RHSA-2026:21338
    https://access.redhat.com/errata/RHSA-2026:21772
    https://access.redhat.com/errata/RHSA-2026:22465
    https://access.redhat.com/errata/RHSA-2026:22619
    https://access.redhat.com/errata/RHSA-2026:22629
    https://access.redhat.com/errata/RHSA-2026:22840
    https://access.redhat.com/errata/RHSA-2026:23361
    https://access.redhat.com/errata/RHSA-2026:24536
    https://access.redhat.com/errata/RHSA-2026:24539
    https://access.redhat.com/errata/RHSA-2026:24853
    https://access.redhat.com/errata/RHSA-2026:24977
    https://access.redhat.com/errata/RHSA-2026:25041
    https://access.redhat.com/errata/RHSA-2026:25089
    https://access.redhat.com/errata/RHSA-2026:25271
    https://access.redhat.com/errata/RHSA-2026:25273
    https://access.redhat.com/errata/RHSA-2026:26214
    https://access.redhat.com/errata/RHSA-2026:26225
    https://access.redhat.com/errata/RHSA-2026:26232
    https://access.redhat.com/errata/RHSA-2026:33574
    https://access.redhat.com/errata/RHSA-2026:36882
    https://access.redhat.com/errata/RHSA-2026:48670
    https://access.redhat.com/security/cve/CVE-2026-42043
    https://bugzilla.redhat.com/show_bug.cgi?id=2461626
    https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42043.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High