Description
shouldBypassProxy, introduced in v1.15.0 to fix CVE-2025-62718, does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.15.0, < 1.16.0 <= 0.31.1** Patched version(s): **1.16.0 0.32.0**
References
Could your website be exposed too?
SmartScanner can check your website for axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Ax - CVE-2026-42043
- Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
You might also like:
See something that needs correcting? Let us knowUpdated July 20, 2026