kritisch
CVE-2026-42043
axios: Axios: NO_PROXY bypass via crafted URL
In der Trivy Database seit spätestens 24. Okt. 2026, 07:11 UTCWann der Eintrag vor diesem Build hinzukam, ist nicht erfasst.
Einstufung nach Quelle
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
GHSA7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Red Hat7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Trivys eigenes Label ist CRITICAL. Kritisch laut NVD. Niedriger laut GHSA (hoch), Red Hat (hoch), Ubuntu (mittel).
Beschreibung
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.
Betroffene Pakete und behobene Versionen
| Quelle | Paket | Behoben in |
|---|---|---|
| chainguard | arangodb-3.11, awx, gitlab-rails-ce-18.11 und 37 weitere | 3.11.14.5-r14 und 35 weitere |
| debian 11 | node-axios | kein Fix angegeben |
| debian 12 | node-axios | kein Fix angegeben |
| debian 13 | node-axios | kein Fix angegeben |
| debian 14 | node-axios | 1.15.2-1 |
| echo | node-axios | kein Fix angegeben |
| echo npm::Echo OSV | axios | 1.12.1+echo.1 |
| minimos | cube-1.7, kibana-8.19, kibana-9.3 und 4 weitere | 1.7.36-r0 und 5 weitere |
| npm::GitHub Security Advisory npm | axios | 1.15.1, 0.31.1 |
| rapidfort debian 12 | node-axios | 0:1.15.2-1 |
| rapidfort debian 13 | node-axios | 0:1.15.2-1 |
| rapidfort ubuntu 20.04 | node-axios | 0:1.16.0-1 |
Alle 98 Einträge aus 21 Quellen zeigen
| Quelle | Paket | Behoben in |
|---|---|---|
| chainguard | arangodb-3.11 | 3.11.14.5-r14 |
| chainguard | awx | 24.6.1-r42 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| chainguard | jitsucom-jitsu | 2.11.0-r22 |
| chainguard | kibana-8.17 | 8.17.10-r21 |
| chainguard | kibana-8.19 | 8.19.15-r0 |
| chainguard | kibana-9.0 | 9.0.8-r24 |
| chainguard | kibana-9.1 | 9.1.10-r16 |
| chainguard | kibana-9.2 | 9.2.8-r0 |
| chainguard | kibana-9.3 | 9.3.4-r4 |
| chainguard | kubeflow-centraldashboard | 1.10.0-r21 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | langfuse-2 | 2.95.12-r23 |
| chainguard | langfuse-3 | 3.174.1-r0 |
| chainguard | langfuse-fips-2 | 2.95.12-r25 |
| chainguard | langfuse-fips-3 | 3.174.1-r0 |
| chainguard | lerna | 9.0.7-r4 |
| chainguard | nextcloud-server-31 | 31.0.14-r5 |
| chainguard | nextcloud-server-33 | 33.0.6-r0 |
| chainguard | nextcloud-server-34 | 34.0.1-r1 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r10 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r10 |
| chainguard | opensearch-dashboards-3 | 3.6.0-r3 |
| chainguard | opensearch-dashboards-3-fips | 3.6.0-r5 |
| chainguard | prism | 5.15.10-r0 |
| chainguard | redisinsight | 3.4.2-r1 |
| chainguard | saf | 1.6.0-r0 |
| chainguard | wazuh-dashboard | 4.14.5-r5 |
| chainguard | wazuh-dashboard-fips | 4.14.5-r5 |
| debian 11 | node-axios | kein Fix angegeben |
| debian 12 | node-axios | kein Fix angegeben |
| debian 13 | node-axios | kein Fix angegeben |
| debian 14 | node-axios | 1.15.2-1 |
| echo | node-axios | kein Fix angegeben |
| echo npm::Echo OSV | axios | 1.12.1+echo.1 |
| minimos | cube-1.7 | 1.7.36-r0 |
| minimos | kibana-8.19 | 8.19.16-r0 |
| minimos | kibana-9.3 | 9.3.5-r0 |
| minimos | kubeflow-pipelines-frontend | 2.17.0-r0 |
| minimos | openclaw | 2026.5.4-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| npm::GitHub Security Advisory npm | axios | 1.15.1, 0.31.1 |
| rapidfort debian 12 | node-axios | 0:1.15.2-1 |
| rapidfort debian 13 | node-axios | 0:1.15.2-1 |
| rapidfort ubuntu 20.04 | node-axios | 0:1.16.0-1 |
| rapidfort ubuntu 22.04 | node-axios | 0:1.16.0-1 |
| rapidfort ubuntu 24.04 | node-axios | 0:1.16.0-1 |
| Red Hat | grafana | kein Fix angegeben |
| Red Hat | grafana-azure-monitor | kein Fix angegeben |
| Red Hat | grafana-cloudwatch | kein Fix angegeben |
| Red Hat | grafana-elasticsearch | kein Fix angegeben |
| Red Hat | grafana-graphite | kein Fix angegeben |
| Red Hat | grafana-influxdb | kein Fix angegeben |
| Red Hat | grafana-loki | kein Fix angegeben |
| Red Hat | grafana-mssql | kein Fix angegeben |
| Red Hat | grafana-mysql | kein Fix angegeben |
| Red Hat | grafana-opentsdb | kein Fix angegeben |
| Red Hat | grafana-postgres | kein Fix angegeben |
| Red Hat | grafana-prometheus | kein Fix angegeben |
| Red Hat | grafana-selinux | kein Fix angegeben |
| Red Hat | grafana-stackdriver | kein Fix angegeben |
| Red Hat | openshift-service-mesh/kiali-ossmc-rhel8 | kein Fix angegeben |
| Red Hat | openshift-service-mesh/kiali-rhel8 | kein Fix angegeben |
| Red Hat | openshift3/ose-console | kein Fix angegeben |
| Red Hat | openshift4/ose-agent-installer-ui-rhel9 | kein Fix angegeben |
| Red Hat | openshift4/ose-console | kein Fix angegeben |
| Red Hat | openshift4/ose-console-rhel9 | kein Fix angegeben |
| Red Hat | openshift4/ose-monitoring-plugin-rhel9 | kein Fix angegeben |
| Red Hat | satellite/iop-advisor-frontend-rhel9 | kein Fix angegeben |
| Red Hat | satellite/iop-host-inventory-frontend-rhel9 | kein Fix angegeben |
| Red Hat | satellite/iop-vulnerability-frontend-rhel9 | kein Fix angegeben |
| seal npm::Seal Security Database | @seal-security/axios | 0.21.1-sp999, 0.21.4-sp6, 0.26.1-sp999, 0.27.2-sp5, 1.11.0-sp999, 1.12.0-sp999, 1.12.2-sp999, 1.13.2-sp999, 1.3.6-sp999, 1.4.0-sp999, 1.5.0-sp999, 1.5.1-sp999, 1.6.0-sp999, 1.6.7-sp999, 1.6.8-sp999, 1.7.1-sp999, 1.7.2-sp2, 1.7.3-sp999, 1.7.9-sp999, 1.8.1-sp999, 1.8.3-sp999, 1.8.4-sp3 |
| seal npm::Seal Security Database | axios | 0.21.1-sp999, 0.21.4-sp6, 0.26.1-sp999, 0.27.2-sp5, 1.11.0-sp999, 1.12.0-sp999, 1.12.2-sp999, 1.13.2-sp999, 1.3.6-sp999, 1.4.0-sp999, 1.5.0-sp999, 1.5.1-sp999, 1.6.0-sp999, 1.6.7-sp999, 1.6.8-sp999, 1.7.1-sp999, 1.7.2-sp2, 1.7.3-sp999, 1.7.9-sp999, 1.8.1-sp999, 1.8.3-sp999, 1.8.4-sp3 |
| ubuntu 20.04-ESM | node-axios | 0.19.0+dfsg-2ubuntu0.1~esm1 |
| ubuntu 22.04 | node-axios | kein Fix angegeben |
| ubuntu 24.04 | node-axios | kein Fix angegeben |
| ubuntu 26.04 | node-axios | kein Fix angegeben |
| wolfi | jitsucom-jitsu | 2.11.0-r22 |
| wolfi | kubeflow-centraldashboard | 1.10.0-r21 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | langfuse-3 | 3.174.1-r0 |
| wolfi | lerna | 9.0.7-r4 |
| wolfi | nextcloud-server-33 | 33.0.6-r0 |
| wolfi | opensearch-dashboards-3 | 3.6.0-r3 |
| wolfi | prism | 5.15.10-r0 |
| wolfi | saf | 1.6.0-r0 |
Referenzen
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:16476
- https://access.redhat.com/errata/RHSA-2026:16532
- https://access.redhat.com/errata/RHSA-2026:16534
- https://access.redhat.com/errata/RHSA-2026:16535
- https://access.redhat.com/errata/RHSA-2026:16542
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:17468
Alle 47 Referenzen
- https://access.redhat.com/errata/RHSA-2026:17474
- https://access.redhat.com/errata/RHSA-2026:17657
- https://access.redhat.com/errata/RHSA-2026:17699
- https://access.redhat.com/errata/RHSA-2026:19109
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:20889
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:21017
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/errata/RHSA-2026:22465
- https://access.redhat.com/errata/RHSA-2026:22619
- https://access.redhat.com/errata/RHSA-2026:22629
- https://access.redhat.com/errata/RHSA-2026:22840
- https://access.redhat.com/errata/RHSA-2026:23361
- https://access.redhat.com/errata/RHSA-2026:24536
- https://access.redhat.com/errata/RHSA-2026:24539
- https://access.redhat.com/errata/RHSA-2026:24853
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:25041
- https://access.redhat.com/errata/RHSA-2026:25089
- https://access.redhat.com/errata/RHSA-2026:25271
- https://access.redhat.com/errata/RHSA-2026:25273
- https://access.redhat.com/errata/RHSA-2026:26214
- https://access.redhat.com/errata/RHSA-2026:26225
- https://access.redhat.com/errata/RHSA-2026:26232
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:48670
- https://access.redhat.com/security/cve/CVE-2026-42043
- https://advisory.echohq.com/cve/CVE-2026-42043
- https://bugzilla.redhat.com/show_bug.cgi?id=2461626
- https://github.com/advisories/GHSA-pmwg-cvhr-8vh7
- https://github.com/axios/axios
- https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
- https://nvd.nist.gov/vuln/detail/CVE-2026-42043
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42043.json
- https://ubuntu.com/security/notices/USN-8638-1
- https://www.cve.org/CVERecord?id=CVE-2026-42043