Axios: no_proxy bypass via IP alias allows SSRF

Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.

CVE-2026-42038 · CVE overview and exploitation status

EUVD-2026-25604

GHSA-m7pr-hjqh-92cm

cve-program · CVE-2026-42038

• https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm

euvd · EUVD-2026-25604

• https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm

nvd · CVE-2026-42038

• https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm

osv · GHSA-m7pr-hjqh-92cm

• https://github.com/axios/axios/security/advisories/GHSA-m7pr-hjqh-92cm
• https://nvd.nist.gov/vuln/detail/CVE-2026-42038
• https://github.com/axios/axios

• Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, he fix for no_proxy hostname normalization bypass is incomplete. When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route throu… · Advisory content revised · 15 Nov 2026