CVE-2026-42038 — Axios is a promise based HTTP client for the browser and

title: CVE-2026-42038 - Axios Incomplete No_Proxy Bypass Attempt
id: scw-2026-04-24-ai-1
status: experimental
level: high
description: |
  Detects attempts to bypass proxy settings in vulnerable versions of Axios (prior to 1.15.1 and 0.31.1) by sending requests to loopback IP addresses (127.0.0.1, [::1]) when 'no_proxy=localhost' is configured. This indicates an attempt to exploit the incomplete no_proxy hostname normalization bypass vulnerability (CVE-2026-42038) where the application incorrectly routes traffic through the proxy instead of bypassing it.
author: SCW Feed Engine (AI-generated)
date: 2026-04-24
references:
  - https://shimiscyberworld.com/posts/nvd-CVE-2026-42038/
tags:
  - attack.command_and_control
  - attack.t1071.001
logsource:
    category: proxy
detection:
  selection:
      dst_domain|contains:
          - '127.0.0.1'
          - '[::1]'
      dst_port:
          - '80'
          - '443'
      src_ip:
          - '127.0.0.1'
          - '[::1]'
  selection_indicators:
      referer|contains:
          - 'localhost'
  condition: selection AND selection_indicators
falsepositives:
  - Legitimate administrative activity

Source: Shimi's Cyber World · License & reuse