Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-drqq-9mkv-qkbx
Vulnerability ID VCID-drqq-9mkv-qkbx
Aliases CVE-2026-42043
Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.
Status Published
Exploitability 0.5
Weighted Severity 6.5
Risk 3.2
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-183 Permissive List of Allowed Inputs
CWE-441 Unintended Proxy or Intermediary ('Confused Deputy')
CWE-918 Server-Side Request Forgery (SSRF)
System Score Found at
epss 0.00027 https://api.first.org/data/v1/epss?cve=CVE-2026-42043
epss 0.00033 https://api.first.org/data/v1/epss?cve=CVE-2026-42043
cvssv3.1 7.2 https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
ssvc Track https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-42043
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-42043
1134878 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1134878
GHSA-pmwg-cvhr-8vh7 https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-04-27T13:47:20Z/ Found at https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
Exploit Prediction Scoring System (EPSS)
Percentile 0.0749
EPSS Score 0.00027
Published At April 26, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-04-25T23:21:55.436240+00:00 Debian Importer Import https://security-tracker.debian.org/tracker/data/json 38.4.0