HTTP Client Vulnerability in Axios Affects Multiple Versions
CVE-2026-101899

6.9MEDIUM

Key Information:

Vendor

AxiOS

Status
AxiOS
Vendor
CVE Published:
13 October 2026

What is CVE-2026-101899?

The Axios HTTP client, a widely-used library for making HTTP requests in JavaScript applications, has a vulnerability affecting versions 1.15.0 through 1.20.0. This vulnerability arises from the improper handling of NO_PROXY CIDR entries. Instead of evaluating whether a target address falls within the specified CIDR range, Axios erroneously treats it as a textual hostname suffix. Consequently, requests intended to bypass a proxy are erroneously routed through it, enabling potential eavesdropping and manipulation of data for both HTTP and HTTPS traffic. This vulnerability has been addressed in version 1.20.0. It is essential for users to upgrade to this version or later to mitigate the risks associated with this issue.

Affected Version(s)

axios >= 1.15.0, < 1.20.0

References

https://github.com/axios/axios/security/advisories/GHSA-4...
x_refsource_CONFIRM
https://github.com/axios/axios/pull/11141
x_refsource_MISC
https://github.com/axios/axios/commit/d19040bda7a8be2f82c...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.