critical
CVE-2026-42043
axios: Axios: NO_PROXY bypass via crafted URL
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.
Severity by source
NVD10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N
GHSA7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Red Hat7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Trivy's own label is CRITICAL. Rated critical by NVD. Rated lower by GHSA (high), Red Hat (high), Ubuntu (medium).
Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.
Affected packages and fixed versions
| Source | Package | Fixed in |
|---|---|---|
| chainguard | arangodb-3.11, awx, gitlab-rails-ce-18.11 and 37 more | 3.11.14.5-r14 and 35 more |
| debian 11 | node-axios | no fix listed |
| debian 12 | node-axios | no fix listed |
| debian 13 | node-axios | no fix listed |
| debian 14 | node-axios | 1.15.2-1 |
| echo | node-axios | no fix listed |
| echo npm::Echo OSV | axios | 1.12.1+echo.1 |
| minimos | cube-1.7, kibana-8.19, kibana-9.3 and 4 more | 1.7.36-r0 and 5 more |
| npm::GitHub Security Advisory npm | axios | 1.15.1, 0.31.1 |
| rapidfort debian 12 | node-axios | 0:1.15.2-1 |
| rapidfort debian 13 | node-axios | 0:1.15.2-1 |
| rapidfort ubuntu 20.04 | node-axios | 0:1.16.0-1 |
Show all 98 entries from 21 sources
| Source | Package | Fixed in |
|---|---|---|
| chainguard | arangodb-3.11 | 3.11.14.5-r14 |
| chainguard | awx | 24.6.1-r42 |
| chainguard | gitlab-rails-ce-18.11 | 18.11.13-r0 |
| chainguard | gitlab-rails-ce-19.0 | 19.0.10-r0 |
| chainguard | gitlab-rails-ce-19.1 | 19.1.7-r6 |
| chainguard | gitlab-rails-ce-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-19.3 | 19.3.1-r6 |
| chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| chainguard | gitlab-rails-ce-fips-18.11 | 18.11.12-r2 |
| chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| chainguard | gitlab-rails-ce-fips-19.0 | 19.0.9-r3 |
| chainguard | gitlab-rails-ce-fips-19.1 | 19.1.7-r7 |
| chainguard | gitlab-rails-ce-fips-19.2 | 19.2.5-r2 |
| chainguard | gitlab-rails-ce-fips-19.3 | 19.3.1-r3 |
| chainguard | jitsucom-jitsu | 2.11.0-r22 |
| chainguard | kibana-8.17 | 8.17.10-r21 |
| chainguard | kibana-8.19 | 8.19.15-r0 |
| chainguard | kibana-9.0 | 9.0.8-r24 |
| chainguard | kibana-9.1 | 9.1.10-r16 |
| chainguard | kibana-9.2 | 9.2.8-r0 |
| chainguard | kibana-9.3 | 9.3.4-r4 |
| chainguard | kubeflow-centraldashboard | 1.10.0-r21 |
| chainguard | kubeflow-katib | 0.19.0-r40 |
| chainguard | langfuse-2 | 2.95.12-r23 |
| chainguard | langfuse-3 | 3.174.1-r0 |
| chainguard | langfuse-fips-2 | 2.95.12-r25 |
| chainguard | langfuse-fips-3 | 3.174.1-r0 |
| chainguard | lerna | 9.0.7-r4 |
| chainguard | nextcloud-server-31 | 31.0.14-r5 |
| chainguard | nextcloud-server-33 | 33.0.6-r0 |
| chainguard | nextcloud-server-34 | 34.0.1-r1 |
| chainguard | opensearch-dashboards-2 | 2.19.5-r10 |
| chainguard | opensearch-dashboards-2-fips | 2.19.5-r10 |
| chainguard | opensearch-dashboards-3 | 3.6.0-r3 |
| chainguard | opensearch-dashboards-3-fips | 3.6.0-r5 |
| chainguard | prism | 5.15.10-r0 |
| chainguard | redisinsight | 3.4.2-r1 |
| chainguard | saf | 1.6.0-r0 |
| chainguard | wazuh-dashboard | 4.14.5-r5 |
| chainguard | wazuh-dashboard-fips | 4.14.5-r5 |
| debian 11 | node-axios | no fix listed |
| debian 12 | node-axios | no fix listed |
| debian 13 | node-axios | no fix listed |
| debian 14 | node-axios | 1.15.2-1 |
| echo | node-axios | no fix listed |
| echo npm::Echo OSV | axios | 1.12.1+echo.1 |
| minimos | cube-1.7 | 1.7.36-r0 |
| minimos | kibana-8.19 | 8.19.16-r0 |
| minimos | kibana-9.3 | 9.3.5-r0 |
| minimos | kubeflow-pipelines-frontend | 2.17.0-r0 |
| minimos | openclaw | 2026.5.4-r0 |
| minimos | opensearch-dashboards-2 | 2.19.6-r0 |
| minimos | opensearch-dashboards-fips-2 | 2.19.6-r0 |
| npm::GitHub Security Advisory npm | axios | 1.15.1, 0.31.1 |
| rapidfort debian 12 | node-axios | 0:1.15.2-1 |
| rapidfort debian 13 | node-axios | 0:1.15.2-1 |
| rapidfort ubuntu 20.04 | node-axios | 0:1.16.0-1 |
| rapidfort ubuntu 22.04 | node-axios | 0:1.16.0-1 |
| rapidfort ubuntu 24.04 | node-axios | 0:1.16.0-1 |
| Red Hat | grafana | no fix listed |
| Red Hat | grafana-azure-monitor | no fix listed |
| Red Hat | grafana-cloudwatch | no fix listed |
| Red Hat | grafana-elasticsearch | no fix listed |
| Red Hat | grafana-graphite | no fix listed |
| Red Hat | grafana-influxdb | no fix listed |
| Red Hat | grafana-loki | no fix listed |
| Red Hat | grafana-mssql | no fix listed |
| Red Hat | grafana-mysql | no fix listed |
| Red Hat | grafana-opentsdb | no fix listed |
| Red Hat | grafana-postgres | no fix listed |
| Red Hat | grafana-prometheus | no fix listed |
| Red Hat | grafana-selinux | no fix listed |
| Red Hat | grafana-stackdriver | no fix listed |
| Red Hat | openshift-service-mesh/kiali-ossmc-rhel8 | no fix listed |
| Red Hat | openshift-service-mesh/kiali-rhel8 | no fix listed |
| Red Hat | openshift3/ose-console | no fix listed |
| Red Hat | openshift4/ose-agent-installer-ui-rhel9 | no fix listed |
| Red Hat | openshift4/ose-console | no fix listed |
| Red Hat | openshift4/ose-console-rhel9 | no fix listed |
| Red Hat | openshift4/ose-monitoring-plugin-rhel9 | no fix listed |
| Red Hat | satellite/iop-advisor-frontend-rhel9 | no fix listed |
| Red Hat | satellite/iop-host-inventory-frontend-rhel9 | no fix listed |
| Red Hat | satellite/iop-vulnerability-frontend-rhel9 | no fix listed |
| seal npm::Seal Security Database | @seal-security/axios | 0.21.1-sp999, 0.21.4-sp6, 0.26.1-sp999, 0.27.2-sp5, 1.11.0-sp999, 1.12.0-sp999, 1.12.2-sp999, 1.13.2-sp999, 1.3.6-sp999, 1.4.0-sp999, 1.5.0-sp999, 1.5.1-sp999, 1.6.0-sp999, 1.6.7-sp999, 1.6.8-sp999, 1.7.1-sp999, 1.7.2-sp2, 1.7.3-sp999, 1.7.9-sp999, 1.8.1-sp999, 1.8.3-sp999, 1.8.4-sp3 |
| seal npm::Seal Security Database | axios | 0.21.1-sp999, 0.21.4-sp6, 0.26.1-sp999, 0.27.2-sp5, 1.11.0-sp999, 1.12.0-sp999, 1.12.2-sp999, 1.13.2-sp999, 1.3.6-sp999, 1.4.0-sp999, 1.5.0-sp999, 1.5.1-sp999, 1.6.0-sp999, 1.6.7-sp999, 1.6.8-sp999, 1.7.1-sp999, 1.7.2-sp2, 1.7.3-sp999, 1.7.9-sp999, 1.8.1-sp999, 1.8.3-sp999, 1.8.4-sp3 |
| ubuntu 20.04-ESM | node-axios | 0.19.0+dfsg-2ubuntu0.1~esm1 |
| ubuntu 22.04 | node-axios | no fix listed |
| ubuntu 24.04 | node-axios | no fix listed |
| ubuntu 26.04 | node-axios | no fix listed |
| wolfi | jitsucom-jitsu | 2.11.0-r22 |
| wolfi | kubeflow-centraldashboard | 1.10.0-r21 |
| wolfi | kubeflow-katib | 0.19.0-r40 |
| wolfi | langfuse-3 | 3.174.1-r0 |
| wolfi | lerna | 9.0.7-r4 |
| wolfi | nextcloud-server-33 | 33.0.6-r0 |
| wolfi | opensearch-dashboards-3 | 3.6.0-r3 |
| wolfi | prism | 5.15.10-r0 |
| wolfi | saf | 1.6.0-r0 |
References
- https://access.redhat.com/errata/RHSA-2026:14937
- https://access.redhat.com/errata/RHSA-2026:16476
- https://access.redhat.com/errata/RHSA-2026:16532
- https://access.redhat.com/errata/RHSA-2026:16534
- https://access.redhat.com/errata/RHSA-2026:16535
- https://access.redhat.com/errata/RHSA-2026:16542
- https://access.redhat.com/errata/RHSA-2026:16874
- https://access.redhat.com/errata/RHSA-2026:17468
All 47 references
- https://access.redhat.com/errata/RHSA-2026:17474
- https://access.redhat.com/errata/RHSA-2026:17657
- https://access.redhat.com/errata/RHSA-2026:17699
- https://access.redhat.com/errata/RHSA-2026:19109
- https://access.redhat.com/errata/RHSA-2026:19375
- https://access.redhat.com/errata/RHSA-2026:20889
- https://access.redhat.com/errata/RHSA-2026:20938
- https://access.redhat.com/errata/RHSA-2026:21017
- https://access.redhat.com/errata/RHSA-2026:21338
- https://access.redhat.com/errata/RHSA-2026:21772
- https://access.redhat.com/errata/RHSA-2026:22465
- https://access.redhat.com/errata/RHSA-2026:22619
- https://access.redhat.com/errata/RHSA-2026:22629
- https://access.redhat.com/errata/RHSA-2026:22840
- https://access.redhat.com/errata/RHSA-2026:23361
- https://access.redhat.com/errata/RHSA-2026:24536
- https://access.redhat.com/errata/RHSA-2026:24539
- https://access.redhat.com/errata/RHSA-2026:24853
- https://access.redhat.com/errata/RHSA-2026:24977
- https://access.redhat.com/errata/RHSA-2026:25041
- https://access.redhat.com/errata/RHSA-2026:25089
- https://access.redhat.com/errata/RHSA-2026:25271
- https://access.redhat.com/errata/RHSA-2026:25273
- https://access.redhat.com/errata/RHSA-2026:26214
- https://access.redhat.com/errata/RHSA-2026:26225
- https://access.redhat.com/errata/RHSA-2026:26232
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:36882
- https://access.redhat.com/errata/RHSA-2026:48670
- https://access.redhat.com/security/cve/CVE-2026-42043
- https://advisory.echohq.com/cve/CVE-2026-42043
- https://bugzilla.redhat.com/show_bug.cgi?id=2461626
- https://github.com/advisories/GHSA-pmwg-cvhr-8vh7
- https://github.com/axios/axios
- https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7
- https://nvd.nist.gov/vuln/detail/CVE-2026-42043
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42043.json
- https://ubuntu.com/security/notices/USN-8638-1
- https://www.cve.org/CVERecord?id=CVE-2026-42043