CVE catalog

CVE-2026-42043

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 ra

[CVE catalog]

Severity
High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.71% · Oct 25, 2026

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debiannode-axiossid1.20.0-1fixed
Debiannode-axiosforky1.20.0-1fixed
Debiannode-axiostrixie1.8.4+dfsg-1vulnerable
Debiannode-axiosbookworm1.2.1+dfsg-1+deb12u1vulnerable
Cpenode-axiosNot reportedNot reportedvulnerable
CpeaxiosNot reported0.31.1fixed
CpeaxiosNot reported1.15.1fixed
NpmaxiosNot reported0.31.1fixed
NpmaxiosNot reported0.31.1fixed
Ubuntunode-axiosnoble1.6.8+dfsg-2ubuntu0.1~esm1fixed
CpeaxiosNot reported1.15.1fixed
Ubuntunode-axiospro1.11.0+dfsg-1vulnerable
Ubuntunode-axiospro1.12.1+dfsg-1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1build1vulnerable
Ubuntunode-axiospro1.13.2+dfsg-1ubuntu0.1~esm1fixed
Ubuntunode-axios25.101.7.9+dfsg-1vulnerable
Ubuntunode-axios25.101.8.4+dfsg-1vulnerable
Ubuntunode-axios25.101.11.0+dfsg-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debiannode-axiossourcesid1.15.2-1not yet assignedNot reported[1134878]
Debiannode-axiossourceforky1.15.2-1not yet assignedNot reported[1134878]
Debiannode-axiossourcetrixie(unfixed)not yet assignedNot reported[1134878]
Debiannode-axiossourcebookworm(unfixed)not yet assignedNot reported[1134878]
CpeaxioscpeNot reported0.31.1Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.15.1Not reportedNot reportedNot reported
NpmaxiosnpmNot reported0.31.1Not reportedGHSA-PMWG-CVHR-8VH7Not reported
NpmaxiosnpmNot reported0.31.1Not reportedNot reportedNot reported
Ubuntunode-axiosdebnoble1.6.8+dfsg-2ubuntu0.1~esm1Not reportedNot reportedNot reported
CpeaxioscpeNot reported1.15.1Not reportedNVD-CVE-2026-42043Not reported
Ubuntunode-axiosdebpro1.13.2+dfsg-1ubuntu0.1~esm1Not reportedUBUNTU-CVE-2026-42043Not reported

[Debian bug #1134878]

Notes

[trixie] node-axios: Minor issue [bookworm] node-axios: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [node-axios]Affected
    Details (2)

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

    • 1.2.1+dfsg-1+deb12u1 · all · bookworm

      Affected

      nvd · node-axios · debian · bookworm; nvd · node-axios · debian · 12

[Debian 13 (Trixie)]

  • [node-axios]Affected
    Details (2)

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

    • 1.8.4+dfsg-1 · all · trixie

      Affected

      nvd · node-axios · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [Ubuntu Security Notices (USN)]