Axios, a promise-based HTTP client for browsers and Node.js, improperly applies NO_PROXY rules to certain loopback addresses in versions prior to 1.15.1 and 0.31.1. This incomplete handling allows an attacker who can control the target URL of an Axios request to use any address in the 127.0.0.0/8 range (other than 127.0.0.1) to bypass proxy restrictions, potentially resulting in server-side request forgery (CVE-2026-42043). This vulnerability is related to an earlier incomplete fix (CVE-2025-62718). The issue is resolved in Axios 1.15.1 and 0.31.1. Ubuntu has issued security notices and patches for multiple affected versions through Ubuntu Pro ESM.

An attacker able to influence the target URL of an Axios request can bypass NO_PROXY restrictions to access internal services via loopback addresses other than 127.0.0.1. This can lead to server-side request forgery, potentially exposing internal network resources or sensitive data. The CVSS v3.1 score is 10.0 (critical), indicating high impact on confidentiality and integrity without requiring privileges or user interaction.

A fix is available. Users should update Axios to version 1.15.1 or later, or 0.31.1 or later. Ubuntu users should apply the security updates provided via Ubuntu Pro Extended Security Maintenance (ESM) for their respective distributions. Standard system updates that include these package versions will remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.