CVE-2026-101899

medium

Description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

References

https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx

https://github.com/axios/axios/releases/tag/v1.20.0

https://github.com/axios/axios/pull/11141

https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-98835

Details

Source: Mitre, NVD

Published: 2026-10-13

Updated: 2026-10-13

Named Vulnerability: GHSA-44g4-m2mj-wpvx

Risk Information

CVSS v2

Base Score: 5.8

Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 7.5

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Severity: High

CVSS v4

Base Score: 6.9

Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N

Severity: Medium