CVE-2026-101899

6.9Medium

Published 13 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

6.9Medium

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Limited impact
Weakness: CWE-693

Impact

A configured proxy can intercept requests meant to bypass it, exposing sensitive plaintext HTTP traffic or HTTPS metadata. This happens whenever an application relies on CIDR notation in the NO_PROXY environment variable.

Root cause

The shouldBypassProxy function checks NO_PROXY CIDR entries as exact hostname text suffixes rather than parsing and matching the IP network range.

Affected systems

Axios 1.15.0 through versions before 1.20.0

CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Fix & remediation

Upgrade axios to 1.20.0 or higher. If upgrading must wait, replace CIDR ranges in the NO_PROXY environment variable with explicit IP addresses or hostnames.

shell

$ npm install axios@^1.20.0

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-101899