CVE-2026-42043 Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Axios 1.15.0

🗓️ 24 Apr 2026 17:54:42Reported by GitHub_MType

Axios CVE-2026-42043 allows NO_PROXY bypass for 127.0.0.0/8 in v1.15.0; fixed in v1.15.1 and v0.31.1.

Reporter	Title	Published	Views	Family All 70
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Axios	15 May 202609:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Monitor Component uses axios-1.15.0.tgz which is vulnerable to CVE-2026-42033, CVE-2026-42034, CVE-2026-42035, CVE-2026-42036, CVE-2026-42037	29 May 202607:20	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple axios vulnerabilities (CVE-2026-42033 through CVE-2026-42044).	2 Jun 202611:26	–	ibm
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in axios	21 May 202616:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Visual Inspection component uses axios-1.15.0.tgz which is vulnerable to multiple CVEs.	1 Jun 202607:54	–	ibm
ATTACKERKB	CVE-2026-42043	24 Apr 202617:54	–	attackerkb
Chainguard	CVE-2026-42043 vulnerabilities	5 May 202619:17	–	cgr
Circl	CVE-2026-42043	24 Apr 202619:23	–	circl
CNNVD	Axios 安全漏洞	24 Apr 202600:00	–	cnnvd
CVE	CVE-2026-42043	24 Apr 202617:54	–	cve

[
  {
    "vendor": "axios",
    "product": "axios",
    "versions": [
      {
        "version": ">= 1.0.0, < 1.15.1",
        "status": "affected"
      },
      {
        "version": "< 0.31.1",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7

24 Apr 2026 17:54Current

CVSS 3.17.2

EPSS0.0006

axios no proxy bypass loopback subnet 127.0.0.0/8 version fix