Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSummary
CVE-2026-42043 is a high-severity Permissive List of Allowed Inputs (CWE-183) vulnerability in Axios Axios. Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Proxy (T1090); ranked at the 48th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to AC-16 (Security and Privacy Attributes) and AC-4 (Information Flow Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2026-42043 is a vulnerability in Axios, a promise-based HTTP client used in browsers and Node.js environments. It affects versions prior to 1.15.1 and 0.31.1, stemming from an incomplete fix for CVE-2025-62718. The flaw allows an attacker who can influence the target URL of an Axios request to bypass NO_PROXY protection by using any address in the 127.0.0.0/8 range except 127.0.0.1. The vulnerability is rated 7.2 on the CVSS v3.1 scale (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) and is associated with CWE-183, CWE-441, and CWE-918.
An attacker with the ability to control or influence the target URL in an Axios request—such as through user-supplied input or manipulated parameters—can exploit this remotely over the network with low complexity and no privileges or user interaction required. Successful exploitation bypasses NO_PROXY protections, potentially enabling server-side request forgery (SSRF) or similar attacks by directing requests to loopback addresses that evade proxy bypass rules, resulting in limited confidentiality and integrity impacts with a changed scope.
The GitHub security advisory (GHSA-pmwg-cvhr-8vh7) confirms the issue is fixed in Axios versions 1.15.1 and 0.31.1. Security practitioners should update to these patched versions immediately and review applications using Axios for URL validation to prevent influence by untrusted inputs.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-25608
Vulnerability Data
Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, an attacker who can influence the target URL of an Axios request can use any address in the 127.0.0.0/8 range (other than 127.0.0.1)…
more
to completely bypass the NO_PROXY protection. This vulnerability is due to an incomplete for CVE-2025-62718, This vulnerability is fixed in 1.15.1 and 0.31.1.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V1.5.2V4.4.2V3.2.1V3.5.1
Mitigating Controls (NIST 800-53 r5) AI
Associating and preserving security attributes such as original source identity prevents the loss of provenance that creates the confused deputy.
Information flow enforcement requires preserving and checking source attributes before forwarding requests outside the trust boundary.
Strict validity checks on inputs directly stop overly permissive allow lists from being used as the protection mechanism.
Access enforcement directly stops a component from acting on forwarded requests without verifying original source authorizations.
Boundary protection limits and inspects external forwarding, reducing the ability of an intermediary to act as an unintended proxy.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper conveyance and verification of original identity assertions directly prevents loss of request source when forwarding.
Secure SDLC practices directly require rigorous allow-list design and testing that prevents permissive input validation.
Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.
Vulnerability identification processes can discover and record SSRF flaws in web applications.
Enforcing least-privilege authorizations on forwarded requests reduces confused-deputy abuse even if source identity is lost.
Network segmentation and egress controls can limit the damage from successful SSRF requests.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect overly broad allow-lists, but does not inherently prevent their creation.
Access-control rules can limit which upstream identities may cause the product to act on their behalf, reducing confused-deputy risk.
Proper identity management ensures the original requester identity is preserved and validated before the product forwards requests.
Explicit access-rights assignment can restrict the product’s ability to act as an unintended proxy for external actors.
Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.
Privileged-access controls limit the rights the product may exercise on behalf of upstream callers, mitigating confused-deputy abuse.