Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-10-13T15:49:51 axios: Axios: Information disclosure via improper CIDR proxy bypass handling 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N CWE-1025

Axios is a promise-based HTTP client for the browser and Node.js. From 1.15.0 until 1.20.0, Axios shouldBypassProxy treats the NO_PROXY CIDR form as a textual hostname suffix instead of evaluating the network range. A request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured. The CIDR bypass rule is not matched, so the request is sent through the configured proxy. For plaintext HTTP, the proxy can observe and modify URLs, headers, and bodies; for HTTPS, it can observe connection metadata and CONNECT requests. This issue is fixed in version 1.20.0.

A flaw was found in Axios. This vulnerability allows information disclosure when network traffic intended to bypass a proxy is improperly routed through it. Axios fails to parse Classless Inter-Domain Routing (CIDR) notation in proxy bypass lists as IP address ranges, treating them as plain text hostnames instead. As a result, an adversary with access to the configured proxy server can intercept or inspect sensitive request data and connection metadata intended for internal network services.

A moderate information disclosure vulnerability was found in Axios, a promise-based HTTP client for Node.js that Red Hat Hardened Images (Hummingbird) ships as a dependency of its grafana12.4, grafana13.1, and grafana13.2 container images. Axios evaluates Classless Inter-Domain Routing (CIDR) notation entries in NO_PROXY proxy-bypass lists as textual hostname suffixes instead of IP address ranges. When a request targets an address covered by a CIDR entry in NO_PROXY while a proxy is configured, the CIDR bypass rule fails to match and the request is sent through the configured proxy. As a result, an adversary with access to the configured proxy server can observe and modify URLs, headers, and bodies of plaintext HTTP traffic intended for internal network services, and can observe connection metadata and CONNECT requests for HTTPS traffic. Red Hat rated this flaw as moderate severity (CVSS 6.5), consistent with the upstream assessment of moderate severity (CVSS 6.9). The resolution of this issue in the affected Hardened Images streams is delegated to the Hummingbird image maintainers, and a fix has been delivered through the affected image streams. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. The affected Red Hat Hardened Images releases containing the fix have been delivered; update to the latest grafana12.4, grafana13.1, and grafana13.2 image releases to resolve this issue. Red Hat Hardened Images 2026-10-05T00:00:00Z RHSA-2026:76430 grafana13-2-main-13.2.3-0.1.hum1 Red Hat Hardened Images 2026-10-05T00:00:00Z RHSA-2026:76448 grafana13-1-main-13.1.7-0.1.hum1 Red Hat Hardened Images 2026-10-06T00:00:00Z RHSA-2026:76677 grafana12-4-main-12.4.12-0.4.hum1 https://www.cve.org/CVERecord?id=CVE-2026-101899 https://nvd.nist.gov/vuln/detail/CVE-2026-101899 https://github.com/axios/axios/commit/d19040bda7a8be2f82c3c6e1a5bc03917daee39a https://github.com/axios/axios/pull/11141 https://github.com/axios/axios/releases/tag/v1.20.0 https://github.com/axios/axios/security/advisories/GHSA-44g4-m2mj-wpvx