CVE-2026-42038 - Vulnerability Analysis

Overview

Axios before 1.15.1 and 0.31.1 contains a proxy bypass vulnerability caused by incomplete no_proxy hostname normalization in shouldBypassProxy() function, letting attackers route localhost requests through proxy, exploit requires setting no_proxy=localhost.

Severity & Score

Impact

Attackers can route localhost requests through a proxy, potentially exposing internal services or sensitive data.

Mitigation

Update to version 1.15.1 or 0.31.1 or later.

References

• https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner