How NO_PROXY bypass via crafted URL happens in Node.js axios and how to fix it

Introduction

In this Node.js project, a high-severity vulnerability was discovered in the axios HTTP client dependency. The yarn.lock file pinned axios at version 1.15.0, which contains a critical flaw in how it processes URLs when determining whether to apply NO_PROXY exclusion rules.

Looking at the dependency declaration in the project's .pnp.cjs file:

["axios", "npm:1.15.0"],

This version of axios is vulnerable to CVE-2026-42043, which allows attackers to craft URLs that bypass NO_PROXY configurations. For any Node.js application that relies on proxy exclusion rules to protect internal services, this vulnerability could expose sensitive traffic to external proxy servers.

The Vulnerability Explained

What is NO_PROXY and Why Does It Matter?

In enterprise environments, applications often use proxy servers to route external HTTP traffic. The NO_PROXY environment variable (or configuration option) specifies hosts that should bypass the proxy—typically internal services, localhost, or private network addresses.

For example, a typical configuration might look like:

HTTP_PROXY=http://corporate-proxy.example.com:8080
NO_PROXY=localhost,127.0.0.1,internal.company.com,.local

This tells axios: "Route external traffic through the proxy, but connect directly to internal services."

The Vulnerability Mechanism

CVE-2026-42043 exploits a flaw in how axios parses and validates URLs before checking them against NO_PROXY rules. An attacker can craft a URL that appears to match an internal host to the NO_PROXY check but actually resolves to a different destination—or vice versa.

Consider this attack scenario specific to the affected project:

// The project uses axios for HTTP requests
const axios = require('axios'); // version 1.15.0 - VULNERABLE

// Application expects this to bypass proxy (internal service)
// NO_PROXY includes 'internal.company.com'
const response = await axios.get('http://internal.company.com@attacker.com/api/data');

In vulnerable versions, the URL parsing inconsistency could cause:
1. Requests intended for NO_PROXY hosts to route through the proxy (leaking internal traffic)
2. Requests to external hosts to bypass the proxy (evading security controls)

Real-World Impact

For this specific project (update-adrules), which uses axios alongside @adguard/filters-downloader and @adguard/hostlist-compiler, the vulnerability is particularly concerning:

1. Credential Exposure: If the application makes authenticated requests to internal APIs, those credentials could be exposed to proxy servers
2. Data Leakage: Internal service responses could be logged or intercepted by proxy infrastructure
3. Security Control Bypass: Requests that should go through security-inspecting proxies might bypass them entirely

As noted in the PR assessment: "This is a Node.js library - vulnerabilities affect downstream consumers who use this package."

The Fix

The fix is straightforward but critical: upgrade axios from version 1.15.0 to 1.15.1, which contains proper URL validation before applying proxy exclusion rules.

Before (Vulnerable)

// In .pnp.cjs (or yarn.lock)
["axios", "npm:1.15.0"],  // VULNERABLE

After (Fixed)

// In .pnp.cjs (or yarn.lock)
["axios", "npm:1.15.1"],  // PATCHED

The changes were scoped to two files:
- package.json: Updated the axios version constraint
- yarn.lock: Regenerated to lock the new secure version

What Changed in axios 1.15.1?

The axios maintainers fixed the URL parsing logic to:
1. Normalize URLs before comparing against NO_PROXY patterns
2. Properly handle URL edge cases (userinfo, encoded characters, unusual ports)
3. Ensure consistent parsing between the NO_PROXY check and the actual request destination

Prevention & Best Practices

1. Automated Dependency Scanning

Implement continuous dependency scanning in your CI/CD pipeline:

# Example GitHub Actions workflow
- name: Run Trivy vulnerability scanner
  uses: aquasecurity/trivy-action@master
  with:
    scan-type: 'fs'
    scan-ref: '.'
    severity: 'HIGH,CRITICAL'

2. Keep Dependencies Updated

Use tools like Dependabot or Renovate to automatically propose dependency updates:

// renovate.json
{
  "extends": ["config:base"],
  "vulnerabilityAlerts": {
    "enabled": true
  }
}

3. Lock File Hygiene

Always commit your lock files (yarn.lock, package-lock.json) and regularly audit them:

# Audit for known vulnerabilities
yarn audit
# or
npm audit

4. Defense in Depth

Don't rely solely on application-level proxy settings:
- Use network segmentation to isolate internal services
- Implement mutual TLS for internal service communication
- Monitor proxy logs for anomalous traffic patterns

5. URL Validation

When accepting URLs from external sources, validate them before passing to axios:

const { URL } = require('url');

function validateUrl(urlString) {
  try {
    const url = new URL(urlString);
    // Reject URLs with userinfo (user:pass@host)
    if (url.username || url.password) {
      throw new Error('URLs with credentials are not allowed');
    }
    return url.href;
  } catch (e) {
    throw new Error('Invalid URL');
  }
}

Key Takeaways

• axios 1.15.0 has a critical NO_PROXY bypass vulnerability that can expose internal traffic to external proxy servers
• URL parsing inconsistencies between proxy exclusion checks and actual request routing create security gaps
• Dependency lock files (yarn.lock) must be actively monitored for vulnerable package versions
• The fix requires upgrading to axios 1.15.1 or 0.31.1 - no code changes needed beyond the version bump
• Projects using axios for internal service communication are at highest risk from this vulnerability

How Orbis AppSec Detected This

• Source: The yarn.lock file declaring axios version 1.15.0 as a project dependency
• Sink: Any HTTP request made through axios that relies on NO_PROXY configuration for routing decisions
• Missing control: The vulnerable axios version lacked proper URL normalization before applying proxy exclusion rules
• CWE: CWE-918 (Server-Side Request Forgery) - the vulnerability allows manipulation of HTTP request routing
• Fix: Upgraded axios from 1.15.0 to 1.15.1, which implements correct URL validation before NO_PROXY checks

Orbis AppSec automatically detected this vulnerability and opened a pull request with the fix. Try Orbis AppSec on your repositories to find and fix issues like this automatically.

Conclusion

CVE-2026-42043 demonstrates how subtle parsing inconsistencies in HTTP client libraries can have significant security implications. The NO_PROXY bypass vulnerability in axios 1.15.0 could expose internal traffic, leak credentials, or allow attackers to evade security controls.

The fix is simple—upgrade to axios 1.15.1—but the lesson is broader: dependency management is a critical security practice. Automated scanning tools can catch these issues before they reach production, and keeping dependencies updated is one of the most effective ways to maintain a secure application.

For Node.js developers, this vulnerability serves as a reminder that even well-maintained libraries like axios can have security issues. Regular dependency audits, automated scanning, and prompt patching are essential practices for secure software development.

References

• CWE-918: Server-Side Request Forgery (SSRF)
• OWASP Server-Side Request Forgery Prevention Cheat Sheet
• axios GitHub Repository
• Node.js URL API Documentation
• Semgrep Rules for SSRF
• fix: upgrade axios to 1.15.1, 0.31.1 (CVE-2026-42033)