{ "document": { "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this portal to enhance access to its information and vulnerabilities. The use of this information is subject to the following terms and conditions:\n\nThe vulnerabilities disclosed in this portal are gathered by NCSC-NL from a variety of open sources, which the user can retrieve from other platforms. NCSC-NL makes every reasonable effort to ensure that the content of this portal is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or real-time keeping up-to-date. NCSC-NL does not control nor guarantee the accuracy, relevance, timeliness or completeness of information obtained from these external sources. The vulnerabilities disclosed in this portal are intended solely for the convenience of professional parties to take appropriate measures to manage the risks posed to the cybersecurity. No rights can be derived from the information provided therein.\n\nNCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of the vulnerabilities disclosed in this portal. This includes damage resulting from the inaccuracy of incompleteness of the information contained in it.\nThe information on this page is subject to Dutch law. All disputes related to or arising from the use of this portal regarding the disclosure of vulnerabilities will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings." } ], "publisher": { "category": "coordinator", "contact_details": "cert@ncsc.nl", "name": "National Cyber Security Centre", "namespace": "https://www.ncsc.nl/" }, "title": "CVE-2026-101899", "tracking": { "current_release_date": "2026-10-15T06:03:21.159984Z", "generator": { "date": "2026-02-17T15:00:00Z", "engine": { "name": "V.E.L.M.A", "version": "1.7" } }, "id": "CVE-2026-101899", "initial_release_date": "2026-09-30T15:40:03.203310Z", "revision_history": [ { "date": "2026-09-30T15:40:03.203310Z", "number": "1", "summary": "CVE created.| Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (5).| CWES updated (1)." }, { "date": "2026-09-30T15:40:12.554589Z", "number": "2", "summary": "NCSC Score created." }, { "date": "2026-10-13T16:38:11.184563Z", "number": "3", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| References created (4).| CWES updated (1)." }, { "date": "2026-10-13T16:38:12.388769Z", "number": "4", "summary": "NCSC Score updated." }, { "date": "2026-10-13T16:39:01.966490Z", "number": "5", "summary": "CVSS created.| CWES created (1).| Products created (1).| References created (4).| Description created for source.| Unknown change." }, { "date": "2026-10-13T16:39:02.857546Z", "number": "6", "summary": "NCSC Score updated." }, { "date": "2026-10-14T00:29:34.118895Z", "number": "7", "summary": "Source created.| CVE status created. (valid)| Description created for source.| CVSS created.| Products connected (4).| Product Identifiers created (1).| References created (6).| CWES updated (1).| Vendor_assessment created." }, { "date": "2026-10-14T00:29:35.282381Z", "number": "8", "summary": "NCSC Score updated." }, { "date": "2026-10-14T06:14:28.529812Z", "number": "9", "summary": "CVSS created.| CWES created (1).| Products created (9).| References created (6).| Description created for source.| Unknown change." }, { "date": "2026-10-14T06:14:34.437858Z", "number": "10", "summary": "NCSC Score updated." }, { "date": "2026-10-14T12:48:10.285769Z", "number": "11", "summary": "Source created.| CVE status created. (valid)| Description created for source.| Products connected (1)." }, { "date": "2026-10-15T05:31:45.451761Z", "number": "12", "summary": "Unknown change." }, { "date": "2026-10-15T06:03:16.379496Z", "number": "13", "summary": "EPSS created.| Unknown change." } ], "status": "interim", "version": "13" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:unknown/>=1.15.0|<1.20.0", "product": { "name": "vers:unknown/>=1.15.0|<1.20.0", "product_id": "CSAFPID-9482813" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.0", "product": { "name": "vers:unknown/v1.15.0", "product_id": "CSAFPID-8580142" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.1", "product": { "name": "vers:unknown/v1.15.1", "product_id": "CSAFPID-8580141" } }, { "category": "product_version_range", "name": "vers:unknown/v1.15.2", "product": { "name": "vers:unknown/v1.15.2", "product_id": "CSAFPID-8583063" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.0", "product": { "name": "vers:unknown/v1.16.0", "product_id": "CSAFPID-8925641" } }, { "category": "product_version_range", "name": "vers:unknown/v1.16.1", "product": { "name": "vers:unknown/v1.16.1", "product_id": "CSAFPID-8925639" } }, { "category": "product_version_range", "name": "vers:unknown/v1.17.0", "product": { "name": "vers:unknown/v1.17.0", "product_id": "CSAFPID-8925638" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.0", "product": { "name": "vers:unknown/v1.18.0", "product_id": "CSAFPID-9484963" } }, { "category": "product_version_range", "name": "vers:unknown/v1.18.1", "product": { "name": "vers:unknown/v1.18.1", "product_id": "CSAFPID-9484962" } }, { "category": "product_version_range", "name": "vers:unknown/v1.19.0", "product": { "name": "vers:unknown/v1.19.0", "product_id": "CSAFPID-9484961" } } ], "category": "product_name", "name": "Axios" } ], "category": "vendor", "name": "Axios" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/1", "product": { "name": "vers:rpm/1", "product_id": "CSAFPID-6014972", "product_identification_helper": { "cpe": "cpe:/a:redhat:hummingbird:1" } } } ], "category": "product_name", "name": "Red Hat Hardened Images" }, { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902830" } } ], "category": "product_name", "name": "grafana12.4" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-8902831" } } ], "category": "product_name", "name": "grafana13.1" }, { "branches": [ { "category": "product_version_range", "name": "vers:rpm/unknown", "product": { "name": "vers:rpm/unknown", "product_id": "CSAFPID-9053231" } } ], "category": "product_name", "name": "grafana13.2" } ], "category": "product_family", "name": "Red Hat Hardened Images" } ], "category": "vendor", "name": "Red Hat" }, { "branches": [ { "branches": [ { "branches": [ { "category": "product_version_range", "name": "vers:deb/*", "product": { "name": "vers:deb/*", "product_id": "CSAFPID-1409455" } } ], "category": "product_name", "name": "node-axios" } ], "category": "product_family", "name": "bookworm" } ], "category": "vendor", "name": "Debian" } ] }, "vulnerabilities": [ { "cve": "CVE-2026-101899", "cwe": { "id": "CWE-1025", "name": "Comparison Using Wrong Factors" }, "notes": [ { "category": "description", "text": "## Summary\n\nAxios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.\n\nThis affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure.\n\n## Impact\n\nIf the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid.\n\nThis is a proxy exclusion bypass, not arbitrary proxy injection by itself.\n\n## Affected Functionality\n\nAffected:\n\n- Node.js adapter proxy environment handling.\n- `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents.\n- CIDR entries in `NO_PROXY`.\n\nNot affected:\n\n- Exact host or exact IP `NO_PROXY` entries where axios matching succeeds.\n- Requests configured with `proxy: false`.\n- Browser adapters.\n\n## Technical Details\n\n`lib/helpers/shouldBypassProxy.js` parses each `NO_PROXY` entry into a host and optional port, normalizes hostnames, and then compares exact hostnames, suffix entries, wildcard-prefix entries, and loopback equivalents. It does not parse CIDR notation.\n\nLocal verification on axios `1.18.1`:\n\n```js\nprocess.env.NO_PROXY = '127.0.0.0/8';\nshouldBypassProxy('http://127.0.0.1:1234/'); // false\n```\n\nThe expected result for CIDR-aware bypass policy is `true`.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n1. Set `HTTP_PROXY=http://127.0.0.1:`.\n2. Set `NO_PROXY=127.0.0.0/8`.\n3. Request `http://127.0.0.1:/metadata`.\n4. Observe that axios sends the request through the proxy instead of directly to the internal listener.\n\n## Workarounds\n\nUse exact host or IP entries in `NO_PROXY` for sensitive destinations until CIDR matching is fixed, for example `127.0.0.1,localhost,169.254.169.254`. For individual requests that must not use a proxy, set `proxy: false`.\n\n
\n

Original report

\n \n## Summary\n\nAxios 1.17.0 honors `HTTP_PROXY` / `HTTPS_PROXY` and supports `NO_PROXY` host exclusions, but CIDR-form `NO_PROXY` entries such as `127.0.0.0/8` are not treated as network ranges. As a result, requests to IPs covered by a configured CIDR exclusion may still be sent through the configured proxy.\n\nIn the attached PoC, a request to `127.0.0.1` is sent through `HTTP_PROXY` despite `NO_PROXY=127.0.0.0/8`.\n\nThis can cause proxy exclusion bypass in environments where operators use CIDR notation to exclude loopback, private, internal, Kubernetes, CI, or cloud metadata address ranges from proxying.\n\n## Details\n\nAxios supports proxy environment variables, including `HTTP_PROXY` / `HTTPS_PROXY` and `NO_PROXY`-style exclusions. Axios’s threat model treats environment proxy handling as security-relevant and lists `NO_PROXY` as a mitigation for proxy environment variable hijack, including hardening for CIDR ranges, IPv6 literals, and wildcard patterns. See: https://github.com/axios/axios/blob/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b/THREATMODEL.md#t-r9-proxy-environment-variable-hijack\n\nThe issue is that CIDR-form `NO_PROXY` entries are not interpreted as network ranges. For example:\n\n```text\nNO_PROXY=127.0.0.0/8\nHTTP_PROXY=http://127.0.0.1:\nTarget URL=http://127.0.0.1:/metadata\n```\n\nSince `127.0.0.1` is inside `127.0.0.0/8`, an operator may reasonably expect Axios to bypass the proxy for this request. Instead, Axios sends the request through `HTTP_PROXY`.\n\nThis appears to affect the proxy bypass decision path used for `NO_PROXY` / `no_proxy` handling. The relevant behavior is in Axios's Node proxy handling and `NO_PROXY` evaluation logic, including the `shouldBypassProxy` helper introduced for `no_proxy` hostname normalization and bypass checks.\n\nThe issue is not that Axios ignores `NO_PROXY` entirely. Exact host exclusions work. The issue is specifically that CIDR-form exclusions are silently treated as non-matching host/domain tokens rather than as network ranges, causing the request to be proxied.\n\nThis is security-relevant because CIDR notation is commonly used in container, CI, enterprise proxy, and cloud environments for ranges such as:\n\n```text\n127.0.0.0/8\n10.0.0.0/8\n172.16.0.0/12\n192.168.0.0/16\n169.254.169.254/32\n```\n\nIf operators rely on those entries to prevent internal or metadata-style requests from traversing a proxy, Axios may violate that expectation.\n\n## PoC\n\n```js\nimport http from 'http';\nimport axios from 'axios';\n\nfunction listen(server, host) {\n return new Promise((resolve, reject) => {\n server.once('error', reject);\n server.listen(0, host, () => resolve(server.address().port));\n });\n}\n\nfunction close(server) {\n return new Promise((resolve) => server.close(resolve));\n}\n\nlet proxyHits = 0;\nlet internalHits = 0;\n\nconst internal = http.createServer((req, res) => {\n internalHits += 1;\n res.writeHead(200, { 'content-type': 'text/plain' });\n res.end(`internal service saw ${req.url}`);\n});\n\nconst proxy = http.createServer((req, res) => {\n proxyHits += 1;\n res.writeHead(200, { 'content-type': 'text/plain' });\n res.end(`proxy saw request for ${req.url}`);\n});\n\nconst internalHost = process.env.POC_INTERNAL_HOST || '127.0.0.2';\nconst proxyHost = process.env.POC_PROXY_HOST || '127.0.0.1';\n\nlet internalPort;\nlet proxyPort;\n\ntry {\n internalPort = await listen(internal, internalHost);\n proxyPort = await listen(proxy, proxyHost);\n} catch (error) {\n console.error('Failed to bind local PoC servers.');\n console.error('On some systems 127.0.0.2 is unavailable; try:');\n console.error(' POC_INTERNAL_HOST=127.0.0.1 node poc-no-proxy-cidr-axios.mjs');\n console.error('');\n throw error;\n}\n\nconst targetUrl = `http://${internalHost}:${internalPort}/metadata`;\nconst proxyUrl = `http://${proxyHost}:${proxyPort}`;\nconst noProxy = process.env.POC_NO_PROXY || '127.0.0.0/8';\n\nprocess.env.http_proxy = proxyUrl;\nprocess.env.HTTP_PROXY = proxyUrl;\nprocess.env.no_proxy = noProxy;\nprocess.env.NO_PROXY = noProxy;\n\nconsole.log('Axios NO_PROXY CIDR full axios network PoC');\nconsole.log(`axios VERSION=${axios.VERSION || 'unknown'}`);\nconsole.log(`NO_PROXY=${process.env.no_proxy}`);\nconsole.log(`HTTP_PROXY=${process.env.http_proxy}`);\nconsole.log(`Target URL=${targetUrl}`);\nconsole.log('');\n\ntry {\n const response = await axios.get(targetUrl, {\n timeout: 2000,\n });\n\n console.log(`Response=${response.data}`);\n console.log(`Proxy hits=${proxyHits}`);\n console.log(`Internal direct hits=${internalHits}`);\n console.log('');\n\n if (proxyHits > 0 && internalHits === 0) {\n console.log(`POC RESULT: axios sent the target through the proxy with NO_PROXY=${noProxy}.`);\n } else if (proxyHits === 0 && internalHits > 0) {\n console.log(`POC RESULT: axios bypassed the proxy with NO_PROXY=${noProxy}.`);\n } else {\n console.log('POC RESULT: mixed/ambiguous routing; inspect counts above.');\n }\n} finally {\n delete process.env.http_proxy;\n delete process.env.HTTP_PROXY;\n delete process.env.no_proxy;\n delete process.env.NO_PROXY;\n await close(proxy);\n await close(internal);\n}\n```\n\nRun the failing CIDR case:\n\n```bash\nPOC_INTERNAL_HOST=127.0.0.1 node poc-no-proxy-cidr-axios.mjs\n```\n\nObserved:\n\n```text\nAxios NO_PROXY CIDR full axios network PoC\naxios VERSION=1.17.0\nNO_PROXY=127.0.0.0/8\nHTTP_PROXY=http://127.0.0.1:34315\nTarget URL=http://127.0.0.1:43993/metadata\n\nResponse=proxy saw request for http://127.0.0.1:43993/metadata\nProxy hits=1\nInternal direct hits=0\n\nPOC RESULT: axios sent the target through the proxy with NO_PROXY=127.0.0.0/8.\n```\n\n## Control\n\nAxios does honor exact IP `NO_PROXY` entries:\n\n```bash\nPOC_INTERNAL_HOST=127.0.0.1 POC_NO_PROXY=127.0.0.1 node poc-no-proxy-cidr-axios.mjs\n```\n\nExpected:\n\n```text\nNO_PROXY=127.0.0.1\nResponse=internal service saw /metadata\nProxy hits=0\nInternal direct hits=1\n\nPOC RESULT: axios bypassed the proxy with NO_PROXY=127.0.0.1.\n```\n\nThis shows the issue is not that `NO_PROXY` is ignored entirely. The bypass failure is specific to CIDR-form entries such as `127.0.0.0/8`.\n\n## Impact\n\nThis is a proxy exclusion bypass caused by unsupported CIDR matching in `NO_PROXY`.\n\nThe impact is configuration-dependent. It affects Axios users in Node.js environments who rely on proxy environment variables and configure `NO_PROXY` using CIDR notation to exclude internal, loopback, private, Kubernetes, CI, or cloud metadata ranges.\n\nPotentially impacted environments include:\n\n- CI/CD runners with globally injected `HTTP_PROXY` / `HTTPS_PROXY`.\n- Containers inheriting proxy variables from the host or orchestrator.\n- Kubernetes workloads using `NO_PROXY` for cluster-internal service ranges.\n- Enterprise networks using HTTP proxies with internal network exclusions.\n- Cloud workloads relying on `NO_PROXY` to keep metadata or internal service requests off proxy infrastructure.\n\nIf a configured proxy is compromised, attacker-controlled, overly broad, or outside the intended trust boundary, requests that operators expected to stay direct may instead be exposed to that proxy. This may expose request URLs, internal hostnames, paths, headers, or credentials depending on application behavior.\n\nThis should not be characterized as arbitrary proxy injection by itself. The issue is that Axios silently fails to enforce common CIDR-form proxy exclusions, which can undermine proxy bypass policy and defense-in-depth assumptions.\n
\n\n---", "title": "osvnpm - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-44g4-m2mj-wpvx.json?alt=media" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.", "title": "nvd - https://nvd.nist.gov/vuln/detail/CVE-2026-101899" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.", "title": "cveprojectv5 - https://www.cve.org/CVERecord?id=CVE-2026-101899" }, { "category": "description", "text": "A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing (CIDR) notation in proxy bypass lists as IP address ranges, treating them as plain text hostnames instead. As a result, an adversary with access to the configured proxy server can intercept or inspect sensitive request data and connection metadata intended for internal network services.", "title": "redhat - https://access.redhat.com/security/cve/CVE-2026-101899" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.", "title": "osvgit - https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101899.json?alt=media" }, { "category": "description", "text": "Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.", "title": "debian - https://security-tracker.debian.org/tracker/CVE-2026-101899" }, { "category": "description", "text": "## Summary\n\nAxios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.\n\nThis affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure.\n\n## Impact\n\nIf the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid.\n\nThis is a proxy exclusion bypass, not arbitrary proxy injection by itself.\n\n## Affected Functionality\n\nAffected:\n\n- Node.js adapter proxy environment handling.\n- `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents.\n- CIDR entries in `NO_PROXY`.\n\nNot affected:\n\n- Exact host or exact IP `NO_PROXY` entries where axios matching succeeds.\n- Requests configured with `proxy: false`.\n- Browser adapters.\n\n## Technical Details\n\n`lib/helpers/shouldBypassProxy.js` parses each `NO_PROXY` entry into a host and optional port, normalizes hostnames, and then compares exact hostnames, suffix entries, wildcard-prefix entries, and loopback equivalents. It does not parse CIDR notation.\n\nLocal verification on axios `1.18.1`:\n\n```js\nprocess.env.NO_PROXY = '127.0.0.0/8';\nshouldBypassProxy('http://127.0.0.1:1234/'); // false\n```\n\nThe expected result for CIDR-aware bypass policy is `true`.\n\n## Proof of Concept of Attack\n\nConstrained local demonstration:\n\n1. Set `HTTP_PROXY=http://127.0.0.1:`.\n2. Set `NO_PROXY=127.0.0.0/8`.\n3. Request `http://127.0.0.1:/metadata`.\n4. Observe that axios sends the request through the proxy instead of directly to the internal listener.\n\n## Workarounds\n\nUse exact host or IP entries in `NO_PROXY` for sensitive destinations until CIDR matching is fixed, for example `127.0.0.1,localhost,169.254.169.254`. For individual requests that must not use a proxy, set `proxy: false`.\n\n
\n

Original report

\n \n## Summary\n\nAxios 1.17.0 honors `HTTP_PROXY` / `HTTPS_PROXY` and supports `NO_PROXY` host exclusions, but CIDR-form `NO_PROXY` entries such as `127.0.0.0/8` are not treated as network ranges. As a result, requests to IPs covered by a configured CIDR exclusion may still be sent through the configured proxy.\n\nIn the attached PoC, a request to `127.0.0.1` is sent through `HTTP_PROXY` despite `NO_PROXY=127.0.0.0/8`.\n\nThis can cause proxy exclusion bypass in environments where operators use CIDR notation to exclude loopback, private, internal, Kubernetes, CI, or cloud metadata address ranges from proxying.\n\n## Details\n\nAxios supports proxy environment variables, including `HTTP_PROXY` / `HTTPS_PROXY` and `NO_PROXY`-style exclusions. Axios’s threat model treats environment proxy handling as security-relevant and lists `NO_PROXY` as a mitigation for proxy environment variable hijack, including hardening for CIDR ranges, IPv6 literals, and wildcard patterns. See: https://github.com/axios/axios/blob/a8e4f13aeecc45a3b8fab3ecfd9ddb5d70fb772b/THREATMODEL.md#t-r9-proxy-environment-variable-hijack\n\nThe issue is that CIDR-form `NO_PROXY` entries are not interpreted as network ranges. For example:\n\n```text\nNO_PROXY=127.0.0.0/8\nHTTP_PROXY=http://127.0.0.1:\nTarget URL=http://127.0.0.1:/metadata\n```\n\nSince `127.0.0.1` is inside `127.0.0.0/8`, an operator may reasonably expect Axios to bypass the proxy for this request. Instead, Axios sends the request through `HTTP_PROXY`.\n\nThis appears to affect the proxy bypass decision path used for `NO_PROXY` / `no_proxy` handling. The relevant behavior is in Axios's Node proxy handling and `NO_PROXY` evaluation logic, including the `shouldBypassProxy` helper introduced for `no_proxy` hostname normalization and bypass checks.\n\nThe issue is not that Axios ignores `NO_PROXY` entirely. Exact host exclusions work. The issue is specifically that CIDR-form exclusions are silently treated as non-matching host/domain tokens rather than as network ranges, causing the request to be proxied.\n\nThis is security-relevant because CIDR notation is commonly used in container, CI, enterprise proxy, and cloud environments for ranges such as:\n\n```text\n127.0.0.0/8\n10.0.0.0/8\n172.16.0.0/12\n192.168.0.0/16\n169.254.169.254/32\n```\n\nIf operators rely on those entries to prevent internal or metadata-style requests from traversing a proxy, Axios may violate that expectation.\n\n## PoC\n\n```js\nimport http from 'http';\nimport axios from 'axios';\n\nfunction listen(server, host) {\n return new Promise((resolve, reject) => {\n server.once('error', reject);\n server.listen(0, host, () => resolve(server.address().port));\n });\n}\n\nfunction close(server) {\n return new Promise((resolve) => server.close(resolve));\n}\n\nlet proxyHits = 0;\nlet internalHits = 0;\n\nconst internal = http.createServer((req, res) => {\n internalHits += 1;\n res.writeHead(200, { 'content-type': 'text/plain' });\n res.end(`internal service saw ${req.url}`);\n});\n\nconst proxy = http.createServer((req, res) => {\n proxyHits += 1;\n res.writeHead(200, { 'content-type': 'text/plain' });\n res.end(`proxy saw request for ${req.url}`);\n});\n\nconst internalHost = process.env.POC_INTERNAL_HOST || '127.0.0.2';\nconst proxyHost = process.env.POC_PROXY_HOST || '127.0.0.1';\n\nlet internalPort;\nlet proxyPort;\n\ntry {\n internalPort = await listen(internal, internalHost);\n proxyPort = await listen(proxy, proxyHost);\n} catch (error) {\n console.error('Failed to bind local PoC servers.');\n console.error('On some systems 127.0.0.2 is unavailable; try:');\n console.error(' POC_INTERNAL_HOST=127.0.0.1 node poc-no-proxy-cidr-axios.mjs');\n console.error('');\n throw error;\n}\n\nconst targetUrl = `http://${internalHost}:${internalPort}/metadata`;\nconst proxyUrl = `http://${proxyHost}:${proxyPort}`;\nconst noProxy = process.env.POC_NO_PROXY || '127.0.0.0/8';\n\nprocess.env.http_proxy = proxyUrl;\nprocess.env.HTTP_PROXY = proxyUrl;\nprocess.env.no_proxy = noProxy;\nprocess.env.NO_PROXY = noProxy;\n\nconsole.log('Axios NO_PROXY CIDR full axios network PoC');\nconsole.log(`axios VERSION=${axios.VERSION || 'unknown'}`);\nconsole.log(`NO_PROXY=${process.env.no_proxy}`);\nconsole.log(`HTTP_PROXY=${process.env.http_proxy}`);\nconsole.log(`Target URL=${targetUrl}`);\nconsole.log('');\n\ntry {\n const response = await axios.get(targetUrl, {\n timeout: 2000,\n });\n\n console.log(`Response=${response.data}`);\n console.log(`Proxy hits=${proxyHits}`);\n console.log(`Internal direct hits=${internalHits}`);\n console.log('');\n\n if (proxyHits > 0 && internalHits === 0) {\n console.log(`POC RESULT: axios sent the target through the proxy with NO_PROXY=${noProxy}.`);\n } else if (proxyHits === 0 && internalHits > 0) {\n console.log(`POC RESULT: axios bypassed the proxy with NO_PROXY=${noProxy}.`);\n } else {\n console.log('POC RESULT: mixed/ambiguous routing; inspect counts above.');\n }\n} finally {\n delete process.env.http_proxy;\n delete process.env.HTTP_PROXY;\n delete process.env.no_proxy;\n delete process.env.NO_PROXY;\n await close(proxy);\n await close(internal);\n}\n```\n\nRun the failing CIDR case:\n\n```bash\nPOC_INTERNAL_HOST=127.0.0.1 node poc-no-proxy-cidr-axios.mjs\n```\n\nObserved:\n\n```text\nAxios NO_PROXY CIDR full axios network PoC\naxios VERSION=1.17.0\nNO_PROXY=127.0.0.0/8\nHTTP_PROXY=http://127.0.0.1:34315\nTarget URL=http://127.0.0.1:43993/metadata\n\nResponse=proxy saw request for http://127.0.0.1:43993/metadata\nProxy hits=1\nInternal direct hits=0\n\nPOC RESULT: axios sent the target through the proxy with NO_PROXY=127.0.0.0/8.\n```\n\n## Control\n\nAxios does honor exact IP `NO_PROXY` entries:\n\n```bash\nPOC_INTERNAL_HOST=127.0.0.1 POC_NO_PROXY=127.0.0.1 node poc-no-proxy-cidr-axios.mjs\n```\n\nExpected:\n\n```text\nNO_PROXY=127.0.0.1\nResponse=internal service saw /metadata\nProxy hits=0\nInternal direct hits=1\n\nPOC RESULT: axios bypassed the proxy with NO_PROXY=127.0.0.1.\n```\n\nThis shows the issue is not that `NO_PROXY` is ignored entirely. The bypass failure is specific to CIDR-form entries such as `127.0.0.0/8`.\n\n## Impact\n\nThis is a proxy exclusion bypass caused by unsupported CIDR matching in `NO_PROXY`.\n\nThe impact is configuration-dependent. It affects Axios users in Node.js environments who rely on proxy environment variables and configure `NO_PROXY` using CIDR notation to exclude internal, loopback, private, Kubernetes, CI, or cloud metadata ranges.\n\nPotentially impacted environments include:\n\n- CI/CD runners with globally injected `HTTP_PROXY` / `HTTPS_PROXY`.\n- Containers inheriting proxy variables from the host or orchestrator.\n- Kubernetes workloads using `NO_PROXY` for cluster-internal service ranges.\n- Enterprise networks using HTTP proxies with internal network exclusions.\n- Cloud workloads relying on `NO_PROXY` to keep metadata or internal service requests off proxy infrastructure.\n\nIf a configured proxy is compromised, attacker-controlled, overly broad, or outside the intended trust boundary, requests that operators expected to stay direct may instead be exposed to that proxy. This may expose request URLs, internal hostnames, paths, headers, or credentials depending on application behavior.\n\nThis should not be characterized as arbitrary proxy injection by itself. The issue is that Axios silently fails to enforce common CIDR-form proxy exclusions, which can undermine proxy bypass policy and defense-in-depth assumptions.\n
\n\n---", "title": "github - https://github.com/advisories/GHSA-44g4-m2mj-wpvx" }, { "category": "other", "text": "0.00526", "title": "EPSS" }, { "category": "other", "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "title": "CVSSV4" }, { "category": "other", "text": "6.9", "title": "CVSSV4 base score" }, { "category": "other", "text": "3.8", "title": "NCSC Score" }, { "category": "other", "text": "The value of the most recent CVSS (V3) score, There is cwe data available from source Nvd", "title": "NCSC Score top decreasing factors" }, { "category": "details", "text": "Severity: 2\n", "title": "Vendor assessment" } ], "product_status": { "known_affected": [ "CSAFPID-9482813", "CSAFPID-6014972", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-9053231", "CSAFPID-8580142", "CSAFPID-8580141", "CSAFPID-8583063", "CSAFPID-8925641", "CSAFPID-8925639", "CSAFPID-8925638", "CSAFPID-9484963", "CSAFPID-9484962", "CSAFPID-9484961" ], "known_not_affected": [ "CSAFPID-1409455" ] }, "references": [ { "category": "external", "summary": "Source - github", "url": "https://github.com/advisories/GHSA-44g4-m2mj-wpvx" }, { "category": "external", "summary": "Source - ncscclear", "url": "https://vulnerabilities.ncsc.nl/manual/CVE-2026-101899" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/npm%2FGHSA-44g4-m2mj-wpvx.json?alt=media" }, { "category": "external", "summary": "Source - nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101899" }, { "category": "external", "summary": "Source - cveprojectv5", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101899" }, { "category": "external", "summary": "Source - redhat", "url": "https://access.redhat.com/security/cve/CVE-2026-101899" }, { "category": "external", "summary": "Source - osv", "url": "https://www.googleapis.com/download/storage/v1/b/osv-vulnerabilities/o/GIT%2FCVE-2026-101899.json?alt=media" }, { "category": "external", "summary": "Source - debian", "url": "https://security-tracker.debian.org/tracker/CVE-2026-101899" }, { "category": "external", "summary": "Source - first", "url": "https://api.first.org/data/v1/epss" }, { "category": "external", "summary": "Reference - github", "url": "https://github.com/advisories/GHSA-44g4-m2mj-wpvx" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/pull/11141" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/releases/tag/v1.20.0" }, { "category": "external", "summary": "Reference - cveprojectv5; github; nvd; osv; redhat", "url": "https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx" }, { "category": "external", "summary": "Reference - osv; redhat", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101899" }, { "category": "external", "summary": "Reference - redhat", "url": "https://www.cve.org/CVERecord?id=CVE-2026-101899" }, { "category": "external", "summary": "Reference - osv", "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101899.json" } ], "scores": [ { "cvss_v3": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "baseScore": 6.5, "baseSeverity": "MEDIUM" }, "products": [ "CSAFPID-6014972", "CSAFPID-8580141", "CSAFPID-8580142", "CSAFPID-8583063", "CSAFPID-8902830", "CSAFPID-8902831", "CSAFPID-8925638", "CSAFPID-8925639", "CSAFPID-8925641", "CSAFPID-9053231", "CSAFPID-9482813", "CSAFPID-9484961", "CSAFPID-9484962", "CSAFPID-9484963" ] } ], "title": "CVE-2026-101899" } ] }