Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
## Summary Axios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy. This affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure. ## Impact If the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid. This is a proxy exclusion bypass, not arbitrary proxy injection by itself. ## Affected Functionality Affected: - Node.js adapter proxy environment handling. - `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents. - CIDR entries in `NO_PROXY`. Not affected: - Exact host or exact IP `NO_PROXY` entries where axios matching succeeds. - Requests configured with `proxy: false`. - Browser adapters. ## Technical Details `lib/helpers/shouldBypassProxy.js` parses each `NO_PROXY` entry into a host and optional port, normalizes hostnames, and then compares exact hostnames, suffix entries, wildcard-prefix entries, and
GHSA-44g4-m2mj-wpvx
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:GHSA-44g4-m2mj-wpvx
axios
Source reference: /affected/0/package/name
- Affected versions
- Not stated in this record
- Fixed versions
- 1.20.0
Source reference:
/affected/0/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "1.15.0"
},
{
"fixed": "1.20.0"
}
]
}
],
"package": {
"name": "axios",
"purl": "pkg:npm/axios",
"ecosystem": "npm"
},
"database_specific": {
"source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/09/GHSA-44g4-m2mj-wpvx/GHSA-44g4-m2mj-wpvx.json"
}
}
]- Related CVEs
- CVE-2026-101899
Source reference:
/aliases
Publisher severity
No explicit severity was provided.
- Event
- #39282 · Revision 1
- Added to Heist Feed
- Publisher date