CVE-2026-42043: Axios NO_PROXY Protection Bypass via RFC 1122 Loopback Subnet

Vulnerability ID: CVE-2026-42043

CVSS Score: 7.2

Published: 2026-05-05

Axios versions prior to 1.15.1 and 0.31.1 contain a security control bypass vulnerability in the NO_PROXY implementation. The issue originates from an incomplete fix for a previous vulnerability (CVE-2025-62718). By targeting non-standard loopback IP addresses within the 127.0.0.0/8 subnet, an attacker can bypass internal traffic protections and force Axios to route requests through an external proxy. This results in Server-Side Request Forgery (SSRF) and Confused Deputy attacks.

TL;DR

Axios fails to validate the full 127.0.0.0/8 loopback subnet, allowing attackers to supply non-standard local IPs (e.g., 127.0.0.2) to bypass NO_PROXY rules and maliciously route internal traffic through external proxies.

⚠️ Exploit Status: POC

Technical Details

CWE ID : CWE-183, CWE-441, CWE-918

Attack Vector : Network

CVSS v3.1 : 7.2

EPSS Score : 0.00044

Impact :…