Axios Vulnerabilities Expose Web Apps to SSRF and Header Injection
Multiple Axios flaws allow attackers to bypass proxy settings and manipulate HTTP headers, risking server-side request forgery and privilege escalation.
TL;DR
- Four CVEs affect Axios, a popular JavaScript HTTP client, enabling SSRF and header injection.
- Flaws include improper NO_PROXY handling, prototype pollution in headers and JSON responses.
- One vulnerability impacts Ubuntu 26.04 LTS specifically, allowing auth bypass.
- Developers should update Axios and review proxy configurations immediately.
- These issues highlight risks of client-side libraries in backend environments.
A series of high-severity vulnerabilities have been identified in Axios, a widely used promise-based HTTP client for JavaScript. These flaws enable attackers to bypass proxy restrictions, inject malicious headers, and in some cases, escalate privileges or bypass authentication mechanisms.
The issues stem from weaknesses in how Axios handles NO_PROXY rules and protects against prototype pollution. Organizations using Axios—especially within Node.js backends—should take immediate action to assess exposure and patch affected systems.
Proxy Bypass Enables Server-Side Request Forgery
- CVE-2025-62718 and CVE-2026-42043 relate to incorrect hostname evaluation when applying NO_PROXY rules.
- Attackers can exploit these flaws to route traffic through unintended paths, accessing internal services.
- This misconfiguration can lead to server-side request forgery (SSRF), exposing sensitive infrastructure.
Prototype Pollution Risks Header and Response Manipulation
- CVE-2026-40175 allows prototype pollution affecting outbound HTTP header values.
- Successful exploitation leads to HTTP header injection, which may compromise downstream systems.
- CVE-2026-42044 affects only Ubuntu 26.04 LTS and enables prototype pollution during JSON response parsing.
- This specific flaw could result in authorization bypass or privilege escalation in impacted environments.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.