PT-2026-35052 · Npm · Axios

Sachinpatilpsp · Publicado 2026-04-24 · Atualizado 2026-05-18 · CVE-2026-42043

Positive Technologies (AI Summary) · Pt

CVSS v3.1

10

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Axios versões anteriores a 1.15.1 Axios versões anteriores a 0.31.1

Description Um invasor capaz de influenciar a URL de destino de uma requisição pode burlar a proteção NO PROXY utilizando qualquer endereço na faixa 127.0.0.0/8, exceto 127.0.0.1.

Recommendations Atualizar para a versão 1.15.1. Atualizar para a versão 0.31.1.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

CWE-183

CWE-441

Identificadores relacionados

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42043

GHSA-PMWG-CVHR-8VH7

Produtos afetados

Axios

Referências · 214

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7 · Exploit
• https://github.com/axios/axios · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-BE61221.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-LC05413.json · Nota
• https://osv.dev/vulnerability/CVE-2026-44458 · Nota
• https://osv.dev/vulnerability/ghsa-83g3-92jg-28cx · Nota
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-42043 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-25639 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-35213 · Nota
• https://osv.dev/vulnerability/ghsa-6475-r3vj-m8vf · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-30827 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2026-4926 · Nota
• https://osv.dev/vulnerability/CVE-2025-69873 · Nota
• https://osv.dev/vulnerability/ghsa-p77w-8qqv-26rm · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Nota de Segurança