CVE-2026-101899

Awaiting Analysis Awaiting Analysis - Queue

Axios Proxy Bypass via NO_PROXY CIDR Misinterpretation

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101899

EUVD

EUVD-2026-98835

Affected Vendors & Products

Vendor	Product	Version / Range
axios	axios	>= 1.15.0, < 1.20.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-693	The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

Attack-Flow Graph

Executive Summary

Axios versions 1.15.0 to 1.20.0 incorrectly handle CIDR-form NO_PROXY entries. Instead of treating them as IP ranges, they are treated as text suffixes. This causes requests to internal IP ranges covered by CIDR entries to be sent through a configured proxy, potentially exposing sensitive traffic.

Detection Guidance

To detect this vulnerability, check if your Axios version is between 1.15.0 and 1.20.0. Run: npm list axios or node -e "console.log(require('axios/package.json').version)". If the version is in this range, the system is vulnerable. Also verify NO_PROXY settings for CIDR entries like 127.0.0.0/8 or 10.0.0.0/8 to see if they are not properly excluding traffic.

Impact Analysis

If you use Axios with NO_PROXY set to CIDR ranges (e.g., 10.0.0.0/8), requests to those IPs may go through a proxy. This could expose plaintext HTTP traffic or HTTPS metadata to the proxy, risking data interception or modification.

Compliance Impact

Exposing internal traffic to untrusted proxies may violate data protection requirements in GDPR or HIPAA, as it risks unauthorized access or interception of sensitive data during transmission.

Mitigation Strategies

Upgrade Axios to version 1.20.0 or later. Alternatively, avoid using CIDR notation in NO_PROXY and use exact hostnames or IP addresses instead. For individual requests, set proxy: false to bypass proxy settings.

Hi! I’m here to help you understand CVE-2026-101899. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70