USN-8638-1: Axios vulnerabilities

In plain language

What this advisory means

Axios, a popular tool used to send web requests, has several security weaknesses. Attackers could exploit these flaws to bypass proxy restrictions, access internal services they shouldn't, inject harmful data into web requests, or change application responses to gain unauthorized access.

Technical explanation

How the issue affects the environment

Multiple vulnerabilities affect Axios's handling of NO_PROXY rules, enabling bypass of proxy restrictions and potential server-side request forgery (CVE-2025-62718, CVE-2026-42043). Prototype pollution issues allow attackers to manipulate HTTP header values (CVE-2026-40175), request configuration options (CVE-2026-42264), and JSON response processing (CVE-2026-42044). These manipulations may lead to HTTP header injection, security restriction bypass, authorization bypass, or privilege escalation. The last two vulnerabilities specifically impact Ubuntu 24.04 LTS and 26.04 LTS.

Operational impact

Why teams should care

Successful exploitation could allow attackers to access internal network services despite proxy protections, inject malicious data into outbound requests, and escalate privileges within applications. This may result in data breaches, service disruptions, or unauthorized control over systems using Axios on affected Ubuntu versions.

Affected and fixed releases

Temporary risk reduction

The official source does not specify any workarounds for these vulnerabilities. Users are advised to update promptly.

Evidence and validation checklist

• Axios improperly handled certain hostnames in NO_PROXY rules allowing proxy bypass and SSRF (CVE-2025-62718).
• Axios allowed HTTP header injection via prototype pollution (CVE-2026-40175).
• Axios misapplied NO_PROXY rules to loopback addresses enabling SSRF (CVE-2026-42043).
• Prototype pollution affected JSON response processing, risking authorization bypass and privilege escalation in Ubuntu 26.04 LTS only (CVE-2026-42044).
• Prototype pollution affected request configuration options, allowing modification of outbound HTTP requests and bypass of security restrictions in Ubuntu 24.04 and 26.04 LTS (CVE-2026-42264).