CVE-2026-101899: Axios Proxy Exclusion Bypass via CIDR NO_PROXY Entries
Summary
CVE-2026-101899: Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges. Affects axios versions >= 1.15.0, < 1.20.0. Fixed in 1.20.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Axios is a popular JavaScript library used for making HTTP requests from both the browser and Node.js environments. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. Axios supports proxy configuration through environment variables, allowing users to control how requests are routed. However, a vulnerability exists in its handling of CIDR-form NO_PROXY entries, which can lead to unintended proxy usage for internal IP ranges.
Vulnerability Detail
The vulnerability arises from Axios's failure to correctly interpret CIDR-form NO_PROXY entries such as '127.0.0.0/8' or '10.0.0.0/8'. Instead of recognizing these as network ranges, Axios treats them as non-matching tokens. This results in requests to internal IP addresses being sent through the configured proxy, potentially exposing sensitive data to unauthorized parties. The issue affects the Node.js adapter's proxy environment handling and can compromise the security of deployments relying on CIDR notation for proxy exclusions.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, use exact host or IP entries in the NO_PROXY environment variable instead of CIDR notation. For example, set NO_PROXY to '127.0.0.1,localhost,169.254.169.254' to bypass the proxy for these specific addresses. Additionally, for individual requests that must not use a proxy, you can set the proxy option to false in your Axios request configuration:
const response = await axios.get('http://127.0.0.1:1234/metadata', { proxy: false });
Conclusion
The Axios vulnerability CVE-2026-101899 highlights a critical issue with the handling of CIDR-form NO_PROXY entries, leading to potential proxy exclusion bypass. Users are advised to update to the patched version of Axios and implement workarounds until they can do so. Monitoring tools like Vulert can assist in identifying affected applications.
See every vulnerability recorded for axios →
FAQ
The vulnerability allows requests that should bypass the proxy to be sent through it, potentially exposing sensitive data to unauthorized access.
Axios versions from 1.15.0 to 1.19.9 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
As a temporary measure, use exact host or IP entries in the NO_PROXY variable instead of CIDR notation to prevent proxy usage for sensitive requests.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.