PT-2026-35048 · Npm · Axios

Srisowmya2000 · Published 2026-04-24 · Updated 2026-05-18 · CVE-2026-42038

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Axios versions prior to 0.31.1 Axios versions prior to 1.15.1

Description An incomplete fix for no proxy hostname normalization bypass allows requests to 127.0.0.1 and [::1] to route through a proxy even when no proxy=localhost is configured. This occurs because the shouldBypassProxy() function performs pure string matching and fails to resolve IP aliases or loopback equivalents.

Recommendations Update to version 0.31.1 or later. Update to version 1.15.1 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CLEANSTART-2026-BE61221

CLEANSTART-2026-LC05413

CVE-2026-42038

GHSA-M7PR-HJQH-92CM

Affected Products

Axios

References · 213

• 🔥 https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-29086 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33895 · Security Note
• https://osv.dev/vulnerability/GHSA-m7pr-hjqh-92cm · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-42038 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44455 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39407 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42264 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42043 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41238 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39408 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-44457 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-40175 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-42038 · Vendor Advisory