Axios: no_proxy bypass via IP alias allows SSRF

Description

The fix for no_proxy hostname normalization bypass (#10661) is incomplete.When no_proxy=localhost is set, requests to 127.0.0.1 and [::1] still route through the proxy instead of bypassing it.

The shouldBypassProxy() function does pure string matching — it does not resolve IP aliases or loopback equivalents.

Recommendation

Update the axios package to the latest compatible version. Followings are version details:

• Affected version(s): **<= 0.31.0

  >= 1.0.0, < 1.15.1**

• Patched version(s): **0.31.1

  1.15.1**

References

• GHSA-m7pr-hjqh-92cm
• CVE-2026-42038
• CWE-918
• CAPEC-310
• OWASP 2021-A10
• OWASP 2021-A6

Related Issues

• Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
• Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure) - CVE-2026-43995
• Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - CVE-2026-44373
• Nitro has a proxy scope bypass via percent-encoded path traversal in `routeRules` - nitro - CVE-2026-44373

You might also like:

Apache and Express Path Traversal plus Nginx Restriction Bypass Tests with SmartScanner

CSRF, XXE, and 12 Other Security Acronyms Explained

Update Cheat Sheet for Developers

Tags:

npm

axios