CVE-2026-42043: axios NO_PROXY Bypass via Malformed URL

Axios 1.13.6 NO_PROXY Bypass: When Environment Variables Fail

A crafted URL in axios 1.13.6 can trick the HTTP client into routing internal requests through an external proxy, even when NO_PROXY explicitly forbids it. CVE-2026-42043 exploits how axios parses destination URLs before checking them against proxy exclusion lists—malformed or unusually encoded hostnames slip past the pattern matcher, causing sensitive internal traffic to exit through infrastructure an attacker controls.

The vulnerability sits at the intersection of URL parsing and proxy configuration. Most developers trust that setting NO_PROXY=internal.api.company.com guarantees direct connections to that host. This finding proves that trust misplaced when the request URL carries unexpected encoding or structure.

Affected Versions

The Vulnerability Explained

The proxy selection logic in axios 1.13.6 relied on proxy-from-env v1.1.0 and follow-redirects v1.15.11 to determine whether a request should use a proxy. The critical flaw: URL parsing happened after proxy decision-making, or with insufficient normalization, allowing crafted URLs to present a different hostname to the proxy checker than the actual connection target.

Consider axios's dependency configuration in the vulnerable version:

"dependencies": {
  "follow-redirects": "^1.15.11",
  "form-data": "^4.0.5",
  "proxy-from-env": "^1.1.0"
}

An attacker constructing a request like axios.get('http://attacker.com%2f..%2finternal.api.company.com/path') could exploit parsing inconsistencies. The %2f encoded slashes might cause proxy-from-env's pattern matcher to see attacker.com (allowed through proxy) while the actual HTTP connection resolves to internal.api.company.com (supposed to be direct). This bypasses the defense-in-depth that NO_PROXY provides for internal service meshes.

The real-world impact is severe: microservice architectures commonly use NO_PROXY to ensure service-to-service calls stay within the VPC. A bypass exposes internal APIs, metadata endpoints (like EC2 IMDS), and administrative interfaces to external infrastructure.

The Fix

The remediation upgrades axios through a significant dependency restructuring:

Before (v1.13.6):

"axios": "^1.13.6"

After (v1.18.0):

"axios": "^1.18.0"

The resolved axios 1.18.0 introduces three critical changes:

1. https-proxy-agent v5.0.1 added — a new dependency that centralizes proxy handling with strict URL validation before any proxy selection occurs
2. follow-redirects upgraded to ^1.16.0 — cleaner separation between redirect resolution and proxy routing
3. proxy-from-env upgraded to ^2.1.0 — stricter hostname normalization and CIDR matching for NO_PROXY patterns

The lockfile reveals the structural shift:

"dependencies": {
  "follow-redirects": "^1.16.0",
  "form-data": "^4.0.5",
  "https-proxy-agent": "^5.0.1",
  "proxy-from-env": "^2.1.0"
}

The addition of agent-base (required by https-proxy-agent) provides the foundation for proper URL canonicalization. Now when axios prepares a request, https-proxy-agent validates and normalizes the target URL before proxy-from-env evaluates it against NO_PROXY patterns. The encoded-slash bypass and similar techniques fail because the URL is decoded and canonicalized early in the pipeline.

Key Takeaways

• Proxy exclusion logic must normalize before matching: NO_PROXY checks against raw URL strings invite bypasses; canonicalize hostnames first.
• Dependency upgrades can rearchitect security-critical paths: The fix isn't a one-line patch but a restructuring of how axios handles proxy agents.
• follow-redirects versions matter for proxy security: Redirect handling and proxy selection interact in subtle ways; keep both updated.
• Environment-variable-based security controls need defense in depth: NO_PROXY alone is insufficient; validate at the application layer where possible.
• Encoded characters in URLs are an attack surface: Any parsing that treats %2f differently from / creates opportunities for parser differential attacks.

How Orbis AppSec Detected This

Source: The url parameter passed to axios.request(), axios.get(), or any axios HTTP method, accepting user-influenced or externally fetched URLs.

Sink: The proxy selection logic within axios's internal request pipeline, specifically where proxy-from-env evaluates URLs against NO_PROXY patterns without prior canonicalization.

Missing control: URL normalization before proxy exclusion matching; the absence of https-proxy-agent or equivalent strict parsing allowed malformed URLs to evade pattern checks.

CWE: unknown (proxy/relay misconfiguration variant)

Fix: Upgrade axios to 1.18.0, which introduces https-proxy-agent for strict URL validation and updates proxy-from-env to v2.1.0 with improved hostname matching.

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-42043 demonstrates that even mature HTTP clients can mishandle the boundary between URL parsing and security policy enforcement. The axios upgrade to 1.18.0 closes this bypass by restructuring proxy handling around https-proxy-agent's stricter validation. For teams running axios in microservice environments, this isn't a theoretical concern—it's a direct protection against internal service exposure.