CVE-2026-42043Disclosure(axios / axios)

LOWCVSS 10.0 · CRITICAL

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch axios axios systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.

axios CVEs Back to dashboard

0.5/ 10 priority

Sources & remediation

Exploit / PoC references

Other references

Weakness type (CWE)

CWE-183CWE-441CWE-918

Priority

LOW

Exploitation

NONE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

axios

Threat summary

Patch or workaround signal is available
4 mentions across 4 observed days
Momentum state: stable

What's happening

Patch or workaround mentioned in 3 signals
Technical details provided in 3 signals
Disclosure: 3 classified signals
Peaked 3d ago at 1 mentions (2026-04-24); latest day: 1
4 total mentions across 4 days

Affected systems

Vendors

axios

Products

axios

Deep dive

Activity timeline4 mentions / 4d

Signal classification2 categories

Disclosure

375.0%

Patch

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-04-24	1	Disclosure1
2026-04-25	1	Disclosure1
2026-05-05	1	Patch1
2026-07-21	1	Disclosure1

Full discourse4 posts

CVE@CVEnew167d
Disclosure
CVE-2026-42043 Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use… https://www.cve.org/CVERecord?id=CVE-2026-42043
Post summary
The post briefly discloses CVE‑2026‑42043 in Axios, highlights affected major/minor releases, and notes a technical flaw where attackers can manipulate request URLs, implying that patching to version 1.15.1 or 0.31.1 resolves the issue.
00021134
57.7K followersView on X
Upwind Security MDR@UpwindMDR157d
Patch
🚨 Axios vulnerabilities: CVE-2026-42033, CVE-2026-42035, CVE-2026-42043, CVE-2026-42264 Multiple prototype pollution issues in Axios can let attackers manipulate request configs, override headers, and potentially redirect traffic or leak sensitive data. Impacts apps using untrusted input in request building. Upgrade to the latest version ASAP and audit how user input flows into HTTP requests.
Post summary
The post highlights several Axios prototype‑pollution CVEs and urges readers to immediately update to the latest version to mitigate potential data leakage or traffic redirection issues.
0101097
121 followersView on X
Vulmon Vulnerability Feed@VulmonFeeds167d
Disclosure
CVE-2026-42043 Server-Side Request Forgery in Axios via NO_PROXY Bypass in 127.0.0.0/8 ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-42043 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The post announces CVE-2026-42043, noting a Server‑Side Request Forgery flaw in Axios that exploits a NO_PROXY bypass; links to vulnerability details and a notification are provided.
0001176
4.0K followersView on X
MalwareObserver@MalwareObserver79d
Disclosure
🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-42043](https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7) Axios is... https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7 #PatchManagement #Vulnerability #CVE
Post summary
The tweet announces CVE-2026-42043 affecting Axios, linking to a GitHub security advisory that likely contains patch details, but it does not include exploit or PoC information.
0000040
13 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	axios	axios	-	node.js	-

Explore more

Back to dashboard axios CVEs axios vulnerabilities

What researchers are saying

CVE-2026-42043

Upwind Security MDR[verified]@UpwindMDRPatch

The post highlights several Axios prototype‑pollution CVEs and urges readers to immediately update to the latest version to mitigate potential data leakage or traffic redirection issues.

MalwareObserver[verified]@MalwareObserverDisclosure

The tweet announces CVE-2026-42043 affecting Axios, linking to a GitHub security advisory that likely contains patch details, but it does not include exploit or PoC information.

CVE@CVEnewDisclosure

The post briefly discloses CVE‑2026‑42043 in Axios, highlights affected major/minor releases, and notes a technical flaw where attackers can manipulate request URLs, implying that patching to version 1.15.1 or 0.31.1 resolves the issue.

Vulmon Vulnerability Feed@VulmonFeedsDisclosure

The post announces CVE-2026-42043, noting a Server‑Side Request Forgery flaw in Axios that exploits a NO_PROXY bypass; links to vulnerability details and a notification are provided.