CVE-2026-44492
Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)
CVSS Score
8.6
EPSS Score
0.9%
EPSS Percentile
55th
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
| CWE | CWE-918 |
| Vendor | axios |
| Product | axios |
| Published | Jun 11, 2026 |
| Last Updated | Jul 23, 2026 |
Stay Ahead of the Next One
Get instant alerts for axios axios
Be the first to know when new high vulnerabilities affecting axios axios are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None
Affected Versions
axios / axios
>= 1.0.0, < 1.16.0 < 0.32.0
References
github.com: https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-44492 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2487938 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42078 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41064 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30651 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36882 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20938 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:20889 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42142 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36108 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33005 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41951 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36754 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33574 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:26234 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29197 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41928 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36611 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:28964 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:29082 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34766 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27063 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:27044 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36820 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33155 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33160 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33163 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33173 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:33183 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42146 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:43052 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42796 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41066 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41031 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:40262 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:42085 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:41055 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:30650 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:36883