CVE-2026-42043 is a NO_PROXY bypass in Axios, scored CVSS 7.2 (high) in the record. Any loopback address in 127.0.0.0/8 other than 127.0.0.1 slips past the check, so the request goes to the proxy. Upgrade to Axios 1.15.1 on the 1.x line or 0.31.1 on the 0.x line.
What's affected
The Axios advisory lists the npm package axios at versions up to 1.15.0 and up to 0.31.0. The patched versions are 1.15.1 and 0.31.1. The NVD record words it as prior to 1.15.1 and 0.31.1.
This flaw is an incomplete fix for CVE-2025-62718, which dealt with other spellings of local hosts. It matters only where your code sends requests to a URL an outsider can influence, and a proxy is set through environment variables with NO_PROXY protecting local services.
How to check if you're exposed
- List every copy of Axios in the project, including those pulled in by other packages.
npm ls axios
npm explain axios
pnpm why axios
yarn why axios
- Compare each version with the fixed ones. Anything at 1.15.0 or below, or 0.31.0 or below, is affected.
- Check whether your services set an HTTP proxy variable and rely on NO_PROXY to keep local calls off the proxy.
What to do now
- Upgrade Axios to 1.15.1 or later, or 0.31.1 or later on the 0.x line.
- Update the lockfile and rebuild, then rerun the commands above to confirm no old copy remains.
- Do not let user supplied URLs reach server side requests unchecked. Validate the host against an allow list.
- If you cannot upgrade yet, review where the proxy variables are set and whether local services are reachable through the proxy.
Why it matters
The classes are CWE-183, a permissive list of allowed inputs, CWE-441, unintended proxy or intermediary, and CWE-918, server side request forgery. The earlier fix added a fixed list of loopback names, but the loopback block is much larger than one address. A request to another address in the block was not recognized as local, so it was forwarded to the proxy.
The scope changes in the CVSS vector because the request can end up at a service outside the application. The KEV flag is false, and I found no report of exploitation in the wild.
Try it yourself
See how an inventory finds every nested copy of a package, which is the hard part of this fix.
Click through it at your own pace, or open it full screen.
Quick check
Do I need the 0.x fix if I use 1.x?
No. Each line has its own fixed version. Use 1.15.1 or later on 1.x, and 0.31.1 or later on 0.x.
Sources
Last reviewed: 19 October 2026.
