CVE-2026-42038

A flaw was found in Axios, a software library used for making web requests. This vulnerability allows an attacker to bypass the no_proxy configuration, which is designed to prevent certain internal network requests from being sent through an external proxy. Specifically, when no_proxy=localhost is set, requests intended for local system addresses (such as 127.0.0.1 and [::1]) are still routed through the proxy. This could lead to unintended exposure of internal network traffic or sensitive information.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, explicitly include 127.0.0.1 and [::1] in the no_proxy environment variable or application-specific proxy bypass configuration. This ensures that requests to these loopback addresses correctly bypass the proxy, preventing unintended information disclosure.