CVE-2026-101899— Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Quick assessment
Affected
axios axios
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Axios 是一个基于 Promise 的 HTTP 客户端，适用于浏览器和 Node.js 环境。从版本 1.15.0 到 1.20.0（含），Axios 的 函数在处理 环境变量中的 CIDR 格式时，将其当作文本主机名后缀进行匹配，而非正确解析为网络地址范围。当某个请求的目标地址落在 中定义的 CIDR 范围内，且系统同时配置了代理时，由于 CIDR 绕过规则未被正确匹配，该请求仍会被发送至配置的代理服务器。 对于明文 HTTP 请求，代理服务器可以窥探并篡改 URL、请求头及请求体内容；对于 HTTPS 请
Possible ATT&CK Techniques 1 AI
T1043
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-101899
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Source: CVE Program / CVE List V5
Vulnerability Description
Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
保护机制失效
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-101899
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-101899
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-101899 (1)
Vendor Advisories for CVE-2026-101899 (1)
Vendor Pages for CVE-2026-101899 (1)
-
🔗 Release v1.20.0 · axios/axios · GitHub x_refsource_MISC
IV. Related Vulnerabilities
Same product: axios
-
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Option -
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter -
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, -
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization -
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows r
Same vendor: axios
-
CVE-2026-101909
Axios: Prototype Pollution Gadget in axios toFormData Option -
CVE-2026-101908
Axios: Prototype pollution gadget in fetch adapter can alter -
CVE-2026-101907
Axios: maxRedirects: 0 is not enforced by the fetch adapter, -
CVE-2026-101906
Axios: ReDoS (O(N²)) in shouldBypassProxy host normalization -
CVE-2026-101905
Axios: Node HTTP adapter prototype-pollution gadget allows r
Same weakness: CWE-693
-
CVE-2026-110866
Renovate before 44.61.3 minimumReleaseAge Bypass via PR Reba -
CVE-2026-110689
OpenClaw ClawScan Static Scanner runner.go shouldSkipTargetP -
CVE-2026-88838
Busybox: busybox: non-root mount option filter bypass allows -
CVE-2026-94603
Podman: The `podman run` command can be instructed to disabl -
CVE-2026-102734
asteval sandbox escape: arbitrary native memory read/write v
V. Comments for CVE-2026-101899
No comments yet