Loading vulnerability…
CVE-2026-42043 is an incomplete fix in Axios affecting versions prior to 1.15.1 and 0.31.1. The vulnerability is a bypass of the earlier NO_PROXY protection changes introduced for CVE-2025-62718. In Axios 1.15.0, loopback handling was implemented with a hardcoded equivalence check that recognized only localhost, 127.0.0.1, and ::1. Because the implementation did not recognize the full IPv4 loopback range defined by RFC 1122, requests targeting other addresses within 127.0.0.0/8 could be misclassified as external destinations. When a proxy is configured, such requests may be sent through that proxy instead of being excluded by NO_PROXY. This allows an attacker who can influence the target URL of an Axios request to bypass intended protections for loopback-hosted services and route sensitive internal traffic through an intermediary.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
No public exploits tracked yet. Mallory keeps watching.
No public exploit code observed for this vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A critical-severity vulnerability in Axios affecting third-party dependencies used in Atlassian products.
An Axios NO_PROXY patch bypass vulnerability in v1.15.0 that fails to recognize the full 127.0.0.0/8 loopback range, enabling SSRF-related proxy bypass and interception of requests to internal loopback services.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.