Ubuntu 26.04 LTS Axios High Server-Side Request Forgery Issues USN-8638

Audit Linux privileges now to limit compromise, escalation, and system-wide damage. Review Linux Privileges ×

Several security issues were fixed in Axios. Software Description: - node-axios: Promise based HTTP client for the browser and node.js Details: Ameer Assadi discovered that Axios did not properly handle certain hostnames when applying NO_PROXY rules. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. (CVE-2025-62718) It was discovered that Axios did not properly protect certain HTTP header values from prototype pollution. An attacker could possibly use this issue to inject malicious values into outbound requests, resulting in HTTP header injection. (CVE-2026-40175) Sachin Patil and Amol Patil discovered that Axios did not properly apply NO_PROXY rules to certain loopback addresses. An attacker could possibly use this issue to bypass proxy restrictions and access internal services, resulting in server-side request forgery. (CVE-2026-42043) Yu Bao discovered that Axios did not properly p... Read the Full Advisory

Several security issues were fixed in Axios.

Software Description:

- node-axios: Promise based HTTP client for the browser and node.js

Ameer Assadi discovered that Axios did not properly handle certain

hostnames when applying NO_PROXY rules. An attacker could possibly use

this issue to bypass proxy restrictions and access internal services,

resulting in server-side request forgery. (CVE-2025-62718)

It was discovered that Axios did not properly protect certain HTTP

header values from prototype pollution. An attacker could possibly use

this issue to inject malicious values into outbound requests, resulting

in HTTP header injection. (CVE-2026-40175)

Sachin Patil and Amol Patil discovered that Axios did not properly apply

NO_PROXY rules to certain loopback addresses. An attacker could possibly

use this issue to bypass proxy restrictions and access internal

services, resulting in server-side request forgery. (CVE-2026-42043)

Yu Bao discovered that Axios did not properly p...

The problem can be corrected by updating your system to the following package versions: Ubuntu 26.04 LTS node-axios 1.13.2+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 24.04 LTS node-axios 1.6.8+dfsg-2ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 22.04 LTS node-axios 0.26.0+dfsg-1ubuntu0.1~esm1 Available with Ubuntu Pro Ubuntu 20.04 LTS node-axios 0.19.0+dfsg-2ubuntu0.1~esm1 Available with Ubuntu Pro In general, a standard system update will make all the necessary changes.

CVE-2025-62718, CVE-2026-40175, CVE-2026-42043, CVE-2026-42044,

Ubuntu Security Notice USN-8638-1

Get the latest Linux and open source security news straight to your inbox.