CVE-2026-101899: 
JavaScript Analyse et atténuation des vulnérabilités

CVE-2026-101899 is a proxy exclusion bypass vulnerability in the Axios HTTP client library for Node.js, where CIDR-notation entries in the NO_PROXY environment variable are silently ignored rather than interpreted as IP ranges. This causes requests targeting addresses within configured CIDR exclusions (e.g., 127.0.0.0/8, 10.0.0.0/8, 169.254.169.254/32) to be routed through the configured proxy instead of bypassing it. The vulnerability affects axios npm versions >= 1.15.0 and < 1.20.0, and was published on September 16, 2026, with the advisory added to the GitHub Advisory Database on September 30, 2026. It carries a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Axios Security Advisory).

The root cause is classified as CWE-693 (Protection Mechanism Failure): the lib/helpers/shouldBypassProxy.js helper parses each NO_PROXY entry into a host and optional port, then performs exact hostname, suffix, wildcard-prefix, and loopback comparisons — but contains no logic to parse or evaluate CIDR notation. As a result, an entry like 127.0.0.0/8 is treated as a literal hostname token that never matches any request target IP, causing the proxy bypass to silently fail. The flaw is limited to the Node.js adapter and affects HTTP_PROXY, HTTPS_PROXY, NO_PROXY, and their lowercase equivalents; browser adapters and requests configured with proxy: false are unaffected. A public proof-of-concept is included in the advisory, demonstrating that axios.get('http://127.0.0.1/metadata') routes through the proxy despite NO_PROXY=127.0.0.0/8 being set (GitHub Advisory, Axios Security Advisory).

The primary impact is confidentiality exposure to an untrusted or attacker-controlled proxy: for plaintext HTTP targets, the proxy can observe and modify request URLs, headers, and bodies; for HTTPS targets, the proxy receives CONNECT tunnel requests and observes connection metadata that policy intended to keep off proxy infrastructure. Environments most at risk include CI/CD runners with globally injected proxy variables, containers inheriting proxy settings from orchestrators, Kubernetes workloads using NO_PROXY for cluster-internal service ranges, and cloud workloads relying on NO_PROXY to protect metadata endpoints such as 169.254.169.254. The vulnerability does not enable arbitrary proxy injection on its own — a proxy must already be configured — but it undermines defense-in-depth assumptions and can expose internal hostnames, credentials, and sensitive request data to that proxy (GitHub Advisory, Axios Security Advisory).

No in-the-wild exploitation has been reported, and the CVE status remains "Reserved" with no CISA KEV catalog entry. A functional proof-of-concept is publicly documented in the official security advisory, demonstrating the bypass with axios 1.17.0. Exploitation requires that a proxy already be configured via environment variables and that the attacker either control or have visibility into that proxy — making this a configuration-dependent, not universally exploitable, issue. No EPSS score is currently available for this CVE (GitHub Advisory, Axios Security Advisory).

1. Identify a vulnerable deployment: Locate a Node.js application using axios >= 1.15.0, < 1.20.0 in an environment where HTTP_PROXY or HTTPS_PROXY is set (e.g., a CI/CD runner, Kubernetes pod, or containerized service) and NO_PROXY is configured with CIDR notation such as NO_PROXY=10.0.0.0/8 or NO_PROXY=169.254.169.254/32.
2. Position a proxy: Ensure access to or control of the configured proxy server (e.g., a corporate proxy, a compromised intermediary, or a locally controlled listener).
3. Trigger a request to a CIDR-excluded target: Cause the vulnerable application to make an HTTP request to an IP address that falls within the CIDR range listed in NO_PROXY — for example, a request to http://10.0.0.5/api when NO_PROXY=10.0.0.0/8.
4. Observe proxy interception: Because axios's shouldBypassProxy.js does not parse CIDR notation, the request is routed through the configured proxy rather than directly to the target. The proxy receives the full request including URL, headers, and body.
5. Extract sensitive data: From the proxy, capture request URLs, authorization headers, API keys, session tokens, or internal service hostnames that the application transmitted, expecting them to remain off proxy infrastructure (GitHub Advisory, Axios Security Advisory).

• Network: Unexpected outbound connections from Node.js application processes to the configured proxy server for destinations that should be direct (e.g., loopback addresses, RFC 1918 ranges, or cloud metadata IPs like 169.254.169.254); proxy access logs showing CONNECT or GET requests for internal IP addresses.
• Logs: Proxy server logs recording requests to internal hostnames or IP ranges that NO_PROXY CIDR entries were intended to exclude; application logs showing successful responses from the proxy for requests expected to reach internal services directly.
• Configuration: Presence of HTTP_PROXY/HTTPS_PROXY environment variables alongside NO_PROXY entries containing CIDR notation (e.g., /8, /16, /24, /32 suffixes) in Node.js process environments running axios >= 1.15.0, < 1.20.0.

Upgrade axios to version 1.20.0 or later, which adds full IPv4 and IPv6 CIDR matching to NO_PROXY/no_proxy in the shouldBypassProxy.js helper, including bracketed IPv6 and IPv4-mapped IPv6 normalization (Axios v1.20.0 Release, Fix PR #11141). As an interim workaround for deployments that cannot upgrade immediately, replace CIDR entries in NO_PROXY with explicit host or IP listings (e.g., NO_PROXY=127.0.0.1,localhost,169.254.169.254,10.0.0.1). For individual requests that must never traverse a proxy, set proxy: false in the axios request configuration (Axios Security Advisory).

The advisory was published by axios maintainer jasonsaayman on September 16, 2026, and the fix was merged via PR #11141 on August 12, 2026, ahead of the public disclosure. Multiple downstream projects — including chatwoot, OpenMetadata, altinn-studio, and defguard — promptly bumped their axios dependency to 1.20.0 following the advisory publication, indicating broad community awareness and rapid adoption of the patch (Fix PR #11141). No significant independent researcher commentary or media coverage beyond the GitHub advisory ecosystem has been identified.