Skip to content
fr Sign in
6.9 Medium

CVE-2026-101899 Axios is a promise-based HTTP client for the browser and Node.js

Description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

Affected products and versions

Product Affected versions Fixed in
axios 1.15 1.15.0 → < 1.20.0 1.20.0

References

Timeline

  1. Published
  2. Last modified

Other CVEs of axios

The 53 CVEs of axios →
CVE-2026-101909 Axios is a promise-based HTTP client for the browser and Node.js 8.3 High CVE-2026-101908 Axios is a promise-based HTTP client for the browser and Node.js 6.9 Medium CVE-2026-101907 Axios is a promise-based HTTP client for the browser and Node.js 7.0 High CVE-2026-101906 Axios is a promise-based HTTP client for the browser and Node.js 8.2 High
Track this CVE