CVE-2026-101899: axios Protection Mechanism Failure
CVSS: 6.9v4.0MediumAwaiting analysis
AliasesCGA-2876-wqgj-8wp5CGA-4fg4-6mxj-9hwfCGA-4pcq-ffvj-f478CGA-5v74-vgjq-wmvjCGA-8579-89h3-2fhjCGA-8v7q-q2jc-x5gwCGA-8x8h-377v-3gfxCGA-c42j-vj7p-3rr8CGA-cgvm-g5xj-26c4CGA-cjrh-mrr4-r55cCGA-fvw3-rmxx-fvhqCGA-gggm-jx4f-wxxwCGA-gpq2-xh5p-55q8CGA-m5gr-wwc5-h3f5CGA-m77j-jwjf-w4wcCGA-p856-xhp6-qvxjCGA-pqfp-4xxq-8686CGA-pr9h-w5vx-5hcfCGA-pwg3-cmr9-89f7CGA-pxqg-2rg3-ccj2CGA-rv33-67gq-fwmrCGA-vxpf-gq3h-fr5vCGA-wf34-gvqv-fj59CGA-x33m-3rr7-j88fCGA-x56p-gj59-w94xCGA-xmg8-3x49-f233GHSA-44g4-m2mj-wpvxCGA-236v-5pfh-2q53CGA-246j-82pg-h4r3CGA-2632-j7hj-qq8rCGA-2658-v862-rq7fCGA-26jc-86p6-cqp5CGA-2crp-5889-c9qcCGA-2gxm-xc32-pvxmCGA-2jpj-v2xj-xhxfCGA-2rcf-m6hc-8g5vCGA-32j8-jrp5-49f3CGA-3535-8p8x-vx37CGA-35p5-6rwf-45vcCGA-3fm7-r9qg-r3qcCGA-3pg9-2m9f-mxg4CGA-3rhf-2gw2-5c3vCGA-4c4c-j866-hxwpCGA-4fwj-mmrv-6h58CGA-554h-mp39-9mg5CGA-5fwp-7cjx-298wCGA-5v52-26p2-xfm4CGA-5xhg-57cv-cvmjCGA-65q5-3mpp-cj87CGA-6x74-3rfv-fp2jCGA-7563-x834-957hCGA-75h2-p2w3-cwpcCGA-75pg-cxc3-jv4gCGA-7fm7-p3fq-583cCGA-7h8g-hhqh-5j3mCGA-7hw2-29rj-2p2vCGA-8gw5-x2fw-6pq8CGA-8vgj-9f7j-cj7jCGA-944m-xm2p-5g7xCGA-976w-hj3g-w7cqCGA-c45r-599v-w7rxCGA-c7x2-4882-j85gCGA-cc4w-v3f2-9r7hCGA-cc7c-vj4g-4hwxCGA-chm6-8mrq-39m7CGA-cpcj-6vmh-cmxjCGA-crpf-95xq-qm6jCGA-f9rg-3phj-8mhqCGA-fc7w-rgjw-hc72CGA-ffqr-7q33-c8m7CGA-fhhx-rg25-7757CGA-fhqv-f89p-m5rjCGA-fqgc-6qq7-g898CGA-frp5-gh7m-qgh2CGA-fw23-mhp5-756xCGA-fw5v-g73p-cmmrCGA-gjqw-whw6-jhgjCGA-gqh8-mqg8-52xvCGA-gwgj-r7r8-89cxCGA-h2h6-38rf-93fxCGA-h2r6-c6xp-23h9CGA-h3w8-8f5v-gwppCGA-h44j-2gv2-4h3qCGA-h9hj-ww6p-2qhmCGA-h9j8-hpcc-m7wjCGA-hqg8-jpr8-ch6hCGA-hv9j-98j6-39w8CGA-hw92-vhjc-78w2CGA-j6cm-pjhc-mrppCGA-jqf4-287c-qpjqCGA-jr3g-8qc5-4fwwCGA-jv64-5vrg-mwfjCGA-jwrg-96f9-f4g2CGA-m6c2-m66x-gxgpCGA-m754-735p-rfm8CGA-m7g6-44wq-x9gfCGA-mf57-7m63-p366CGA-mjj9-6h4x-fvh5CGA-mw72-5f33-8xrxCGA-mwxg-2fwp-rfwxCGA-p247-8q4g-fwp5CGA-p876-8r8v-4849CGA-p8m3-gg3w-m7p9CGA-pcpr-c6jf-3794CGA-pr99-5xvj-8f5gCGA-prvv-p57p-2gqmCGA-px3h-g882-7v9xCGA-q5xf-pwwc-x6vmCGA-qc8w-rq9c-7v29CGA-qmx4-q3v4-53phCGA-qph2-4299-x283CGA-qq2m-x99w-6pvwCGA-rxgc-r574-4v35CGA-v378-7hv7-3w46CGA-v8jm-wqm4-69wxCGA-vcc3-pjhx-c76cCGA-vx4r-r97p-qcw7CGA-w42g-gq6q-9wf6CGA-w63j-p57c-vj75CGA-wc2p-9r89-4ggfCGA-wfh4-vjj3-9q77CGA-wgg3-w4pg-phfjCGA-wprf-xmwr-hcpwCGA-wq7p-5mcp-7699CGA-x2rc-vwgf-7f9mCGA-x8p6-p6c8-7phfCGA-x9w9-jw78-cjj2CGA-xmj6-jrjq-xq6fCGA-xph9-3c7h-f8xmDEBIAN-CVE-2026-101899CGA-9h84-ccvp-r2mvCGA-fp58-49gw-mh26CGA-4w7r-9jc9-wrjqCGA-9gj5-893m-ph44UBUNTU-CVE-2026-101899
Published 13-10-2026Last modified 14-10-2026
Vulnerability summary
CVE-2026-101899 is a medium (CVSS 6.9) Protection Mechanism Failure vulnerability in axios. EPSS estimates a 0.53% chance of exploitation in the next 30 days, higher than 43.3% of scored vulnerabilities.
CVSS score
6.9/10
010
Medium · v4.0 (CVE.org)EPSS score
0.53%
0%100%
Low · Change unavailableKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 3Timeline
- 13-10-2026PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.
CVSS metrics
6 scores · 6 sources · 1 versionMedium 6.9Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:NSourcesAll 6 agree
- OSV · NpmEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
- NVDNIST6.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · DebianEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated6.9MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
EPSS trend
Probability
0.53%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
Change unavailable
Change unavailable
14-10-202618-10-2026
EPSS score0.53%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard50 products
- awx< 24.6.1-r66
- commercial-gitlab-rails-ee-19.1< 19.1.7-r3
- commercial-gitlab-rails-ee-19.2< 19.2.7-r1
- commercial-gitlab-rails-ee-19.3< 19.3.3-r1
- commercial-gitlab-rails-ee-19.4< 19.4.1-r1
Wolfi7 products
- kubeflow-centraldashboard< 2.0.0-r5
- langfuse-3< 3.225.11-r2
- langfuse-3-worker< 3.225.11-r2
- lerna< 10.0.1-r8
- nextcloud-server-33< 33.0.9-r1
Axios1 product
- axios≥ 1.15.0, < 1.20.0
Debian1 product
- node-axiosAll versions (No fix recorded) | < 1.20.0-1
Npm1 product
- axios≥ 1.15.0, < 1.20.0
Ubuntu1 product
- node-axiosAll versions (No fix recorded)
6 vendors · 61 products
References
10 links- github.com/axios/axiosPACKAGE
