Npm · Axios · CVE-2026-42038
**Name of the Vulnerable Software and Affected Versions**
Axios versions prior to 0.31.1
Axios versions prior to 1.15.1
**Description**
An incomplete fix for no proxy hostname normalization bypass allows requests to 127.0.0.1 and [::1] to route through a proxy even when `no proxy=localhost` is configured. This occurs because the `shouldBypassProxy()` function performs pure string matching and fails to resolve IP aliases or loopback equivalents.
**Recommendations**
Update to version 0.31.1 or later.
Update to version 1.15.1 or later.