PT-2026-44984 · Npm+1 · Axios+1
CVE-2026-44492
·
Published
2026-05-29
·
Updated
2026-07-22
CVSS v3.1
8.6
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
axios versions prior to 0.32.0
axios versions prior to 1.16.0
Description
Axios is a promise-based HTTP client for the browser and Node.js. The issue resides in the
lib/helpers/shouldBypassProxy.js file and is caused by the failure to normalize IPv4-mapped IPv6 addresses. When the NO PROXY list contains an IPv4 address, such as 127.0.0.1 or 169.254.169.254, a request using the IPv4-mapped IPv6 format (e.g., ::ffff:7f00:1 or ::ffff:a9fe:a9fe) is not correctly identified as an exception and is routed through the configured proxy. Because Node.js resolves these addresses to the underlying IPv4 host, the request can reach internal services via the proxy, allowing a remote attacker to bypass existing security restrictions.Recommendations
Update axios to version 0.32.0 or later.
Update axios to version 1.16.0 or later.
Exploit
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Confluence
Axios