CVE-2026-101899

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-101899
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101899.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-101899
Aliases
Downstream
CGA (128)
CLEANSTART (2)
CLSA (2)
MINI (10)
Published
2026-10-13T15:49:51Z
Modified
2026-10-14T02:45:39Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator
Summary
Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges
Details

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-693"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/101xxx/CVE-2026-101899.json"
}
References

Affected packages

Git / github.com/axios/axios

Affected ranges

Type
GIT
Repo
https://github.com/axios/axios
Events
Introduced
772a4e54ecc4cc2421e2b746daff0aca10f359d7
Fixed
84a9f3b9a4f3244b8c8e818f557d64c7b964fb25
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "1.15.0"
        },
        {
            "fixed":  "1.20.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

v1.*
v1.15.0
v1.15.1
v1.15.2
v1.16.0
v1.16.1
v1.17.0
v1.18.0
v1.18.1
v1.19.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-101899.json"