axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CV
- Severity:
- High
Description
shouldBypassProxy, introduced in v1.15.0 to fix CVE-2025-62718, does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.
Recommendation
Update the axios package to the latest compatible version. Followings are version details:
Affected version(s): **>= 1.15.0, < 1.16.0 <= 0.31.1** Patched version(s): **1.16.0 0.32.0**
References
- GHSA-pjwm-pj3p-43mv
- security.access.redhat.com
- bugzilla.redhat.com
- access.redhat.com
- CVE-2026-44492
- CWE-289
- CWE-918
- CAPEC-310
- OWASP 2021-A10
- OWASP 2021-A6
Related Issues
- Axios has a Patch Bypass: Proxy-Authorization Header Injection via Prototype Pollution — Incomplete Null-Prototype Fix - CVE-2026-44489
- Axios: Incomplete Fix for CVE-2025-62718 — NO_PROXY Protection Bypassed via RFC 1122 Loopback Subnet (127.0.0.0/8) in Ax - CVE-2026-42043
- Axios: no_proxy bypass via IP alias allows SSRF - CVE-2026-42038
- TinaCMS rich-text (slatejson) rendering does not sanitize link/image URLs, allowing stored XSS via dangerous URL schemes - CVE-2026-55661
You might also like:
- Tags:
- npm
- axios
Anything's wrong? Let us know Last updated on July 20, 2026