CVE-2026-44492: axios NO_PROXY Bypass via IPv4-Mapped IPv6 Addresses
Summary
CVE-2026-44492: shouldBypassProxy, introduced in v1.15.0 to fix CVE-2025-62718, does not normalise IPv4-mapped IPv6 addresses. Affects axios across 2 version ranges.
< 0.32.0
>= 1.0.0, < 1.16.0
Fixed in 0.32.0 or 1.16.0, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Axios is a popular promise-based HTTP client for the browser and Node.js, widely used for making HTTP requests. It simplifies the process of sending asynchronous HTTP requests to REST endpoints and performing CRUD operations. However, it has a vulnerability that affects its proxy bypass functionality, particularly when dealing with IPv4-mapped IPv6 addresses.
Vulnerability Detail
The vulnerability arises from the 'shouldBypassProxy' function, introduced in version 1.15.0 to address a previous issue (CVE-2025-62718). It fails to normalize IPv4-mapped IPv6 addresses, allowing requests to bypass the NO_PROXY settings. This means that if NO_PROXY is set to exclude certain internal addresses, requests using the IPv4-mapped IPv6 format can still route through the configured proxy, potentially leading to unauthorized access to internal services and cloud metadata, which could result in credential exfiltration.
How To Fix
Latest published version: 1.20.0 as of 22 Oct 2026
npm install axios@1.20.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.32.00.32.0npm install axios@0.32.0 -
>= 1.0.0, < 1.16.01.16.0npm install axios@1.16.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can avoid using IPv4-mapped IPv6 addresses in your requests. Instead, use standard IPv4 addresses or hostnames that are recognized by the NO_PROXY settings. For example, instead of using 'http://[::ffff:127.0.0.1]/', use 'http://127.0.0.1/'.
Conclusion
In summary, CVE-2026-44492 is a significant vulnerability in the axios library that can lead to proxy bypass through IPv4-mapped IPv6 addresses. It is crucial to update to the patched version or implement workarounds to mitigate the risk of unauthorized access to sensitive internal services.
See every vulnerability recorded for axios →
FAQ
CVE-2026-44492 is a vulnerability in the axios library that allows for proxy bypass when using IPv4-mapped IPv6 addresses.
If your application uses axios with NO_PROXY settings, this vulnerability could allow unauthorized access to internal services or cloud metadata.
The CVSS score for this vulnerability is 8.6, indicating a high severity level.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you cannot update axios right away, consider using the workaround of avoiding IPv4-mapped IPv6 addresses in your requests.
References
Related vulnerabilities
Recent vulnerabilities recorded for axios.
