CVE-2026-42038: Axios SSRF Vulnerability

CVE-2026-42038 Overview

CVE-2026-42038 is a Server-Side Request Forgery (SSRF) vulnerability in Axios, a popular promise-based HTTP client for browser and Node.js environments. The vulnerability exists in versions prior to 1.15.1 and 0.31.1 where the fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it as intended. The shouldBypassProxy() function performs pure string matching without resolving IP aliases or loopback equivalents.

Critical Impact

Sensitive internal requests intended to bypass the proxy may be inadvertently routed through an external proxy server, potentially exposing confidential data to untrusted network intermediaries.

Affected Products

• Axios versions prior to 1.15.1 (1.x branch)
• Axios versions prior to 0.31.1 (0.x branch)
• Applications using Axios with no_proxy configuration for localhost

Discovery Timeline

• 2026-04-24 - CVE CVE-2026-42038 published to NVD
• 2026-04-27 - Last updated in NVD database

Technical Details for CVE-2026-42038

Vulnerability Analysis

This vulnerability is classified as CWE-918 (Server-Side Request Forgery). The core issue stems from how Axios handles proxy bypass logic when the no_proxy environment variable or configuration option is set. The shouldBypassProxy() function relies on simple string comparison to determine whether a request should bypass the configured proxy.

When a developer sets no_proxy=localhost to prevent local service calls from being routed through a proxy, the implementation fails to recognize that 127.0.0.1 (IPv4 loopback) and [::1] (IPv6 loopback) are functionally equivalent to localhost. This incomplete hostname normalization means that while requests to localhost bypass the proxy correctly, requests to these IP-based loopback addresses are still sent through the proxy server.

The vulnerability enables network-based attacks where an attacker with control or visibility over the proxy server can intercept requests that were intended to remain local. This is particularly concerning for applications that communicate with local services containing sensitive data or authentication tokens.

Root Cause

The root cause is the incomplete implementation of hostname normalization in the proxy bypass logic. The shouldBypassProxy() function performs direct string matching against the no_proxy list without considering that multiple hostnames and IP addresses can resolve to the same network destination. Specifically, the function does not implement RFC-compliant loopback address recognition or DNS resolution to verify address equivalence.

Attack Vector

The attack vector is network-based and requires no privileges or user interaction. An attacker positioned as a proxy server (legitimately configured or through a man-in-the-middle scenario) can intercept requests that the application developer intended to keep local. This occurs when:

1. An application configures no_proxy=localhost to protect local service communications
2. Internal code or dependencies make HTTP requests using IP addresses (127.0.0.1 or [::1]) instead of the localhost hostname
3. These requests are incorrectly routed through the proxy where they can be logged, modified, or redirected

The vulnerability manifests in the proxy bypass decision logic. When Axios evaluates whether to route a request through the configured proxy, it compares the request hostname against entries in the no_proxy list using exact string matching. This means localhost, 127.0.0.1, and [::1] are treated as distinct hostnames despite all representing the local loopback interface. See the GitHub Security Advisory for detailed technical information.

Detection Methods for CVE-2026-42038

Indicators of Compromise

• Unexpected outbound traffic to proxy servers originating from localhost-bound requests
• Proxy server logs showing requests destined for 127.0.0.1 or [::1] addresses
• Network monitoring alerts for internal service calls traversing external network segments
• Authentication token exposure in proxy access logs for local service endpoints

Detection Strategies

• Audit application dependencies for Axios versions below 1.15.1 (1.x) or 0.31.1 (0.x)
• Review network traffic patterns for proxy-routed requests to loopback addresses
• Implement dependency scanning tools to flag vulnerable Axios versions in CI/CD pipelines
• Monitor proxy logs for unexpected local address requests that should bypass proxy routing

Monitoring Recommendations

• Deploy network monitoring to detect requests to loopback addresses traversing proxy infrastructure
• Configure SIEM rules to alert on localhost/loopback traffic appearing in proxy access logs
• Implement application-level logging to track proxy bypass decisions for auditing
• Set up automated dependency vulnerability scanning with alerts for this CVE

How to Mitigate CVE-2026-42038

Immediate Actions Required

• Upgrade Axios to version 1.15.1 or later for 1.x branch users
• Upgrade Axios to version 0.31.1 or later for 0.x branch users
• Audit no_proxy configurations to include all loopback address variants
• Review application code for hardcoded IP-based localhost references

Patch Information

The vulnerability is fixed in Axios versions 1.15.1 and 0.31.1. The patch improves the shouldBypassProxy() function to properly handle loopback address equivalence. Detailed information about the fix is available in the GitHub Security Advisory.

Workarounds

• Expand no_proxy configuration to include all loopback variants: no_proxy=localhost,127.0.0.1,::1,[::1]
• Refactor application code to consistently use localhost hostname instead of IP addresses for local service calls
• Implement network-level controls to prevent proxy routing of loopback-destined traffic
• Consider disabling proxy configuration entirely for applications that only communicate locally

# Configuration example
# Temporary workaround: Expand no_proxy to include all loopback variants
export no_proxy="localhost,127.0.0.1,::1,[::1]"

# Verify Axios version and upgrade if necessary
npm list axios
npm update axios@1.15.1

# Or for 0.x branch users
npm update axios@0.31.1