Description
Axios supports proxy environment variables and evaluates NO_PROXY exclusions in the Node.js adapter. CIDR-form NO_PROXY entries such as 127.0.0.0/8, 10.0.0.0/8, or 169.254.169.254/32 are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.15.0, < 1.20.0
- Patched version(s): 1.20.0
References
Could your website be exposed too?
SmartScanner can check your website for Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges and gives you actionable findings to investigate.
Start a free scanRelated Issues
- axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV - CVE-2026-44492
- Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios - CVE-2026-67315
You might also like:
See something that needs correcting? Let us knowUpdated September 30, 2026