{"items":[{"id":"NVI-00012992","kind":"vulnerability","title":"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-44g4-m2mj-wpvx","CVE-2026-101899"],"plain_summary":"GitHub lists this reviewed advisory for axios. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-169eac0e616276ffcce7dfe7b2bd7af0"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-11-04T12:03:12.000Z","value":"0.512%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.43806. Missing scores are unknown.","source_id":"sr-169eac0e616276ffcce7dfe7b2bd7af0"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-31b1a9f5a40e8db6b0473a658d2f99d8","url":"https://github.com/advisories/GHSA-44g4-m2mj-wpvx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-44g4-m2mj-wpvx","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:22:52.960Z"},{"id":"sr-169eac0e616276ffcce7dfe7b2bd7af0","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2026-101899","publisher":"FIRST EPSS","observed_at":"2026-11-04T17:58:50.307Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-31b1a9f5a40e8db6b0473a658d2f99d8"],"technology":"axios","known_exclusions":[],"conditions_summary":"## Summary\n\nAxios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.\n\nThis affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure.\n\n## Impact\n\nIf the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid.\n\nThis is a proxy exclusion bypass, not arbitrary proxy injection by itself.\n\n## Affected Functionality\n\nAffected:\n\n- Node.js adapter proxy environment handling.\n- `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents.\n- CIDR entries in `NO_PROXY`.\n\nNot affected:\n\n- Exact host or exact IP `NO_PROXY` entries w","public_affected_ranges":[">= 1.15.0, < 1.20.0"]}],"null_published_at":"2026-11-08T19:53:38.933Z","source_updated_at":"2026-09-30T15:32:34.000Z","source_disclosed_at":"2026-09-30T15:32:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-11-01T07:22:52.960Z"},{"id":"NVI-00012992","kind":"vulnerability","title":"Axios: CIDR-form NO_PROXY entries are ignored, causing proxy exclusion bypass for internal IP ranges","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-44g4-m2mj-wpvx","CVE-2026-101899"],"plain_summary":"GitHub lists this reviewed advisory for axios. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-31b1a9f5a40e8db6b0473a658d2f99d8"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-31b1a9f5a40e8db6b0473a658d2f99d8","url":"https://github.com/advisories/GHSA-44g4-m2mj-wpvx","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-44g4-m2mj-wpvx","publisher":"GitHub Advisory Database","observed_at":"2026-11-01T07:22:52.960Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-31b1a9f5a40e8db6b0473a658d2f99d8"],"technology":"axios","known_exclusions":[],"conditions_summary":"## Summary\n\nAxios supports proxy environment variables and evaluates `NO_PROXY` exclusions in the Node.js adapter. CIDR-form `NO_PROXY` entries such as `127.0.0.0/8`, `10.0.0.0/8`, or `169.254.169.254/32` are not interpreted as IP ranges. As a result, a request to an IP address inside a configured CIDR exclusion can still be sent through the configured proxy.\n\nThis affects deployments that rely on CIDR notation to keep loopback, private, Kubernetes, CI, or cloud metadata traffic away from proxy infrastructure.\n\n## Impact\n\nIf the configured proxy is outside the intended trust boundary, requests that operators expected to bypass the proxy may be exposed to it. For plaintext HTTP targets, the proxy can see and modify URLs, headers, and bodies. For HTTPS targets, the proxy still observes connection metadata and may receive CONNECT requests that policy expected to avoid.\n\nThis is a proxy exclusion bypass, not arbitrary proxy injection by itself.\n\n## Affected Functionality\n\nAffected:\n\n- Node.js adapter proxy environment handling.\n- `HTTP_PROXY`, `HTTPS_PROXY`, `NO_PROXY`, or lowercase equivalents.\n- CIDR entries in `NO_PROXY`.\n\nNot affected:\n\n- Exact host or exact IP `NO_PROXY` entries w","public_affected_ranges":[">= 1.15.0, < 1.20.0"]}],"null_published_at":"2026-11-01T07:29:12.907Z","source_updated_at":"2026-09-30T15:32:34.000Z","source_disclosed_at":"2026-09-30T15:32:30.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-01T07:22:52.960Z"}],"next_cursor":null,"snapshot_revision":"42594"}