Permissive List of Allowed Inputs in axios - CVE-2026-42043

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU127594

Permissive List of Allowed Inputs in axios - CVE-2026-42043

Published: April 24, 2026


Vulnerability identifier: #VU127594
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-42043
CWE-ID: CWE-183
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to bypass proxy restrictions and disclose sensitive information.

The vulnerability exists due to permissive list of allowed inputs in lib/helpers/shouldBypassProxy.js when processing Axios requests to loopback addresses in the 127.0.0.0/8 range. A remote attacker can influence the target URL to bypass proxy restrictions and disclose sensitive information.

Exploitation requires the application to use proxy environment variables and rely on NO_PROXY rules to protect loopback services.


Affected software

axios
IBM Cloud Pak System
IBM MQ Operator
Jira Service Management Data Center
Confluence Data Center
Jira Software Data Center
IBM Decision Optimization for Cloud Pak for Data
IBM supplied MQ Advanced container images
JBoss Data Grid

How to mitigate CVE-2026-42043

Install security update from vendor's website.

axios - addressed in versions 0.31.1, 1.15.1
IBM Cloud Pak System - update to 2.3.5.1
IBM MQ Operator - addressed in versions 3.2.26 SC2, 4.0.1 SC2
Jira Service Management Data Center - addressed in versions 10.3.22, 11.3.7
Confluence Data Center - addressed in versions 9.2.22, 10.2.14
IBM supplied MQ Advanced container images - update to 10.0.0.0-r2
Jira Software Data Center - addressed in versions 10.3.22, 11.3.7
IBM Decision Optimization for Cloud Pak for Data - update to 5.3.1 patch 6
JBoss Data Grid - update to 8.6.1

External References

Related Security Bulletins