CVE-2026-101899

The record

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

Affected packages

Related vulnerabilities

• CVE-2026-113730 OGNL is an Object Graph Navigation Library for Java. CWE-693
• CVE-2026-112077 A vulnerability was detected in radareorg radare2 6.2.0/6.2.2. CWE-693
• CVE-2026-88838 A flaw was found in BusyBox's mount utility. CWE-693
• CVE-2026-107226 The AsyncHttpClient (AHC) library allows Java applications to easily execute HTTP… CWE-693
• CVE-2026-107697 FFmpeg before 8.1.3 contains a protection mechanism failure in the HLS demuxer that… CWE-693
• CVE-2026-105083 ImageMagick before 7.1.2-32 and 6.9.13-57 contains a policy bypass vulnerability in… CWE-693
• CVE-2026-101900 Axios is a promise-based HTTP client for the browser and Node.js. CWE-693
• CVE-2026-93605 vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the… CWE-693