← Vulnerability feed

Vulnerability record · CVE-2026-42038 · published 24 April 2026

CVE-2026-42038: Axios server-side request forgery (ssrf) vulnerability

Axios · Axios

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.

7.5 CVSS 3.1 High EPSS 0.38% · top 70.5% CWE-918 · Server-side request forgery (SSRF)
7.5CVSS 3.1 base score
0.38%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
2References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it. The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. This vulnerability is fixed in 1.15.1 and 0.31.1.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm ExploitMitigationVendor Advisory
https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm ExploitMitigationVendor Advisory

Track CVE-2026-42038 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2026-42043Axios server-side request forgery (ssrf) vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axio…EPSS 0.58%9.8CVE-2024-57965Axios origin validation error vulnerabilityIn axios before 1.7.8, lib/helpers/isURLSameOrigin.js does not use a URL object when determining an origin, and has a potentially unwanted setAttribu…EPSS 0.38%9.1CVE-2026-42264Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From version 1.0.0 to before version 1.15.2, fFive config properties (auth, baseURL…EPSS 0.97%9.1CVE-2026-42044Axios mass assignment vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.15.2, he Axios library is vulnerable to a Prototype Pollutio…EPSS 0.86%8.7CVE-2026-44494Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. From 1.0.0 to before 1.16.0, the Axios library is vulnerable to a Prototype Polluti…EPSS 0.93%8.6CVE-2026-44492Axios server-side request forgery (ssrf) vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. Wh…EPSS 0.78%8.3CVE-2026-67320Axios information exposure vulnerabilityaxios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configurat…EPSS 0.52%8.2CVE-2026-44490Axios prototype pollution vulnerabilityAxios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, axios exposes two read-side prototype-pollution gadgets…EPSS 0.40%

Source: NIST National Vulnerability Database (record CVE-2026-42038), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.