CVE-2026-101899

Executive Summary

CVE-2026-101899 is a security-relevant logic flaw in the Axios HTTP client (versions 1.15.0 through 1.20.0) in which the shouldBypassProxy routine misinterprets NO_PROXY entries written in CIDR notation as literal hostname suffixes rather than as network ranges. Consequently, when an application has a proxy configured and relies on a CIDR-form NO_PROXY rule to reach an internal or trusted address, that request is incorrectly routed through the proxy instead of being sent directly. Any environment that uses CIDR-form NO_PROXY entries with a proxy is affected, and the impact is a confidentiality and integrity risk: the proxy can observe and modify plaintext HTTP traffic and connection metadata/CONNECT requests for HTTPS, effectively functioning as a man-in-the-middle path for destinations the operator explicitly intended to exclude.

Technical Analysis

Axios is a promise-based HTTP client used in both browser and Node.js contexts. A proxy-awareness feature that governs whether a request should skip the configured proxy is implemented via a function named shouldBypassProxy, which evaluates the request target against the NO_PROXY environment/configuration value. The defect introduced in version 1.15.0 is a parsing/semantics error: CIDR entries in NO_PROXY (for example, a range expressed in CIDR form) are treated as textual hostname suffixes. Because matching is performed as a suffix comparison on the target string rather than by checking whether the resolved address falls inside the network range, a genuine CIDR bypass rule is never satisfied for the intended addresses.

The direct consequence of this mismatch is that the bypass is not applied. When both conditions hold — (a) a request targets an address covered by a CIDR entry in NO_PROXY, and (b) a proxy is configured — the request is forwarded to the proxy rather than being sent directly to the destination. This defeats the explicit operator intent encoded in NO_PROXY: the set of destinations that should never traverse the proxy.

The attack surface is the client-side routing decision made by the library at request time. The flaw is classified under CWE-693 (Protection Mechanism Failure) because a protective control (the NO_PROXY bypass list) fails to function as designed. There is no memory-safety issue, no code execution primitive, and no server-side service to exploit directly; the security impact arises entirely from the request being channeled through an intermediary the operator intended to avoid.

Impact by protocol, as stated in the advisory: for plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, the proxy can observe connection metadata and CONNECT requests. This is precisely the classic adversary-in-the-middle exposure (T1557) for traffic that should have bypassed the proxy. The exposure is only realized when a malicious or untrusted proxy is in the request path, which is why the CVSS attack complexity is elevated and the impact is scoped to confidentiality and integrity rather than availability. Note the provided CVSS score is N/A; the vector above reflects the vulnerability class and should be treated as an analytical estimate, not an authoritative score.

Version scope: the issue exists from 1.15.0 until 1.20.0 and is fixed in 1.20.0. The provided affected-version list is empty in the intelligence feed, so the version boundary is taken directly from the NVD description text.

Exploitation Scenarios

No public PoC is available; the attack chain below is inferred at the vulnerability-class level and uses only details contained in the advisory. No specific function names beyond shouldBypassProxy, and no fabricated endpoints or parameters, are used.

1. Reconnaissance / target identification. The adversary must be positioned to serve as, intercept, or control the proxy configured in the victim environment. Where an enterprise forcibly routes HTTP(S) client traffic through a proxy — including a legitimate but untrusted, compromised, or malicious forward proxy — the attacker identifies hosts running Axios within the vulnerable version range (1.15.0 to before 1.20.0) and confirms the environment uses CIDR-form NO_PROXY entries alongside a configured proxy. This combination is the precondition for exploitability.

2. Triggering the flaw. An application process issues a request to a destination that the operator intended to exempt from the proxy via a CIDR entry in NO_PROXY. Because the library treats the CIDR entry as a textual hostname suffix, the bypass does not match, and the request is instead dispatched to the configured proxy. The attacker does not need to inject code; the vulnerable routine misroutes the request itself. Any request type the application generates — API calls, internal-service fetches, token exchanges — can be affected as long as it targets an address covered by a CIDR NO_PROXY rule.

3. Delivery/interception. With the request now flowing through the proxy, the attacker operating that proxy receives it. For plaintext HTTP, the attacker can read and alter URLs, headers, and bodies in transit — enabling credential theft, request tampering, response injection, and redirect manipulation at the proxy layer. For HTTPS, the proxy observes connection metadata and the CONNECT request (destination host/port, timing, volume), and can act on that metadata even though the TLS payload itself remains protected by the target's TLS. In TLS-interception environments where the proxy is trusted to terminate TLS, plaintext is additionally exposed.

4. Post-exploitation impact. The practical outcome is loss of the confidentiality and integrity guarantees the NO_PROXY bypass was meant to preserve: internal or sensitive destinations are exposed to an intermediary that was explicitly supposed to be kept out of their path. Modified requests/responses can translate into logic manipulation, credential exposure, or redirection of client traffic. HTTP is the higher-impact case because content is mutable; HTTPS exposure is limited to metadata and CONNECT-level information unless TLS is terminated at the intermediary. There is no evidence of in-the-wild exploitation and no CISA KEV listing.

Impact Assessment

Business impact centers on confidentiality and integrity of requests that operators deliberately excluded from proxying. In environments where NO_PROXY uses CIDR entries to protect internal services, hostnames, or sensitive APIs from an outbound/forward proxy, the misrouting means those protected destinations traverse an intermediary — potentially a third-party or compromise-prone proxy — contrary to policy and compliance controls.

Affected systems: any application or service that (1) uses Axios versions 1.15.0 through < 1.20.0, (2) has a proxy configured, and (3) depends on CIDR-form NO_PROXY entries. This spans Node.js backends, serverless functions, CI/CD tooling, and browsers bundling the affected library, wherever proxy configuration and CIDR bypass lists coincide.

Blast radius is bounded by the routing precondition: the flaw is only impactful when a proxy is in the path for a request the operator intended to exempt. In deployments without a proxy, or without CIDR-form NO_PROXY entries, there is no exposure. The scope is also protocol-dependent — HTTP destinations are fully exposed to observation and modification, while HTTPS destinations expose connection metadata and CONNECT requests (with full content exposure only where TLS is terminated at the intermediary).

CVSS subscores (analytical, as no score was published): Network attack vector (traffic flows over the network to the proxy), High attack complexity (requires a specific configuration combination and an adversary positioned at the proxy), no privileges or user interaction required, Changed scope (the vulnerable component's trust boundary is crossed when traffic destined for a directly-connected host is instead sent to a third party), and Low confidentiality/integrity impact given the protocol-dependent, metadata-limited nature of the HTTPS case and the precondition of a malicious/untrusted proxy. The overall score is reported as N/A in the source data and no EPSS score has been assigned by FIRST.org; neither should be fabricated.

Detection Guidance

Detection focuses on anomalous proxy-mediated traffic to destinations that should have bypassed the proxy, and on network-layer visibility of requests to CIDR-designated addresses appearing at a proxy.

Sigma Rule

title: Axios NO_PROXY CIDR Bypass - Request Routed Through Proxy
id: 8c1f2a44-9b7e-4d2a-a1c3-3e5f7b9d0c21
status: experimental
description: Detects Axios requests (v1.15.0 to <1.20.0) being sent to a proxy for destinations that were configured to bypass the proxy via CIDR-form NO_PROXY entries.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-101899
  - https://github.com/advisories
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: proxy
detection:
  selection:
    - proxy_bypass_expected: true
    - dest_in_no_proxy_cidr: true
  condition: selection
falsepositives:
  - Legitimate proxy use where NO_PROXY CIDR was intentionally not applied
level: medium
tags:
  - attack.t1557
  - cve.2026.101899

YARA Rule

rule CVE_2026_101899_Axios_ShouldBypassProxy_CIDR
{
    meta:
        description = "Detects Axios source/build artifacts in the vulnerable version range that reference shouldBypassProxy and NO_PROXY CIDR handling"
        reference = "CVE-2026-101899"
        author = "Threat Intelligence"
        date = "2026-01-01"
        severity = "medium"
    strings:
        $fn = "shouldBypassProxy" ascii
        $np = "no_proxy" ascii nocase
        $np2 = "NO_PROXY" ascii
        $vuln1 = "1.15.0" ascii
        $vuln2 = "1.16" ascii
        $vuln3 = "1.17" ascii
        $vuln4 = "1.18" ascii
        $vuln5 = "1.19" ascii
    condition:
        uint32be(0) != 0x7f454c46 and
        $fn and ($np or $np2) and any of ($vuln*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-101899 Axios NO_PROXY CIDR Bypass - Request Routed Through Proxy"; flow:established,to_server; http.method; content:"CONNECT"; http.request_line; content:"CONNECT"; nocase; reference:cve,2026-101899; classtype:policy-violation; sid:2026101899; rev:1;)

Elastic Detection

sequence by process.entity_id with maxspan=5s
  [process where process.name : "node" and process.args : "*axios*"]
  [network where network.direction == "egress" and
     not destination.ip == "127.0.0.1"]

Splunk SPL Query

index=proxy OR index=network
| where match(dest_host, "^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)")
| stats count min(_time) as first_seen max(_time) as last_seen by src_ip dest_host proxy_ip
| where proxy_ip!="" and proxy_ip!="direct"
| sort - count

Wazuh OSSEC Rule

<group name="axios,cve-2026-101899,">
  <rule id="101899" level="10">
    <decoded_as>json</decoded_as>
    <field name="event.category">network</field>
    <field name="destination.ip">\b(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)</field>
    <field name="proxy.bypass.expected">true</field>
    <description>CVE-2026-101899: Axios request to NO_PROXY CIDR destination routed through proxy (possible device-in-the-middle exposure)</description>
    <mitre>
      <id>T1557</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed).

1. Immediate mitigations:

   • Where CIDR-form NO_PROXY entries cannot be trusted to bypass correctly on affected versions, avoid relying on them: express bypass rules using the hostname-suffix forms that the vulnerable routine matches, or route the affected client traffic directly rather than through a proxy.
   • Ensure outbound HTTP(S) client traffic from Axios-bearing applications only traverses proxies that are fully trusted and hardened, since the flaw's impact depends on an untrusted intermediary being in the path.
   • Audit configurations for the combination that triggers the issue: a configured proxy plus CIDR-form NO_PROXY entries, on Axios versions 1.15.0 through < 1.20.0.
   • Network-layer controls (egress filtering, TLS integrity, proxy allow-listing) limit exposure for the HTTPS case, where content is protected but metadata/CONNECT is not.

2. Patch/upgrade steps:

   • Upgrade Axios to 1.20.0, which the advisory states fixes the issue.
   • Inventory dependencies (package-lock.json, npm/yarn/pnpm lockfiles, SBOMs) for axios and flag any resolved version in the range 1.15.0 through < 1.20.0.
   • Because the patch is CLAIMED from a single source (GHSA) and not independently verified, re-validate the behavior against the fixed version in a staging environment before broad rollout, and verify no transitive dependency pins an older Axios.

3. Long-term hardening:

   • Monitor the Axios release stream for a CVE assignment and any revision to the fix; confirm the GHSA-derived patch once authoritative sources publish affected-version and severity detail.
   • Centralize and test proxy/NO_PROXY configuration as code, with assertion tests that verify bypass behavior for each address form (hostname, suffix, CIDR) in CI.
   • Enforce egress transparency controls and TLS hygiene so that any accidental proxy traversal yields minimal metadata leakage.
   • Track CWE-693 (Protection Mechanism Failure) patterns in dependency reviews, prioritizing libraries that implement security-relevant routing, allow-listing, or bypass logic.

References

• NVD — CVE-2026-101899: https://nvd.nist.gov/vuln/detail/CVE-2026-101899
• GitHub Security Advisory (GHSA) — Axios NO_PROXY CIDR bypass, fixed in 1.20.0 (patch source; single-source claim)
• Axios project repository and release notes for version 1.20.0
• MITRE ATT&CK — T1557 Adversary-in-the-Middle: https://attack.mitre.org/techniques/T1557/
• CWE-693 Protection Mechanism Failure: https://cwe.mitre.org/data/definitions/693.html
• FIRST.org EPSS (no score currently assigned for this CVE)

No public PoC, no Nuclei template, and no exploit code are known. CISA KEV listing: No. No threat-actor campaign or exploit-in-the-wild evidence is associated with this CVE at the time of writing.