10

CVE-2026-42043: Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

Modified
AliasesUBUNTU-CVE-2026-42043DEBIAN-CVE-2026-42043CGA-2gwg-fj68-h853
Published 24-04-2026Last modified 10-09-2026

Vulnerability summary

CVE-2026-42043 is a critical (CVSS 10.0) Permissive List of Allowed Inputs vulnerability in axios. EPSS estimates a 0.71% chance of exploitation in the next 30 days, higher than 53.6% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
10.0/10
010
Critical · v3.1 (NVD)
EPSS score
0.71%
0%100%
Low · +0.13 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 0 · Related 2
CGA-J97W-QC8W-FWPFUSN-8638-1

Timeline

  1. 24-04-2026
    PublishedVulnerability first disclosed.
  2. 10-09-2026
    Last modifiedVulnerability information updated.

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.71%

Chance of exploitation in the next 30 days

Percentile

54%

Versus all other CVEs

30-day change

Increase +0.13 pp

From 0.58% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Axios

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard78 products
  • airflow-2All versions (No fix recorded)
  • airflow-core-2All versions (No fix recorded)
  • arangodb-3.11< 3.11.14.5-r14
  • awx< 24.6.1-r42
  • gitlab-rails-ce-18.1All versions (No fix recorded)
Wolfi19 products
  • jitsucom-jitsu-console< 2.11.0-r22
  • katib-earlystopping< 0.19.0-r31
  • katib-suggestion-goptuna-compat< 0.19.0-r40
  • katib-suggestion-hyperband< 0.19.0-r31
  • katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
Axios1 product
  • axios< 0.31.1 | ≥ 1.0.0, < 1.15.1
Debian1 product
  • node-axiosAll versions (No fix recorded) | < 1.15.2-1
Npm1 product
  • axios≥ 1.0.0, < 1.15.1 | < 0.31.1
Ubuntu1 product
  • node-axios< 0.19.0+dfsg-2ubuntu0.1~esm1 | < 0.26.0+dfsg-1ubuntu0.1~esm1 | < 1.6.8+dfsg-2ubuntu0.1~esm1 | All versions (No fix recorded) | < 1.13.2+dfsg-1ubuntu0.1~esm1

6 vendors · 101 products

References

48 links
Show all 48 references