CVE-2026-44492

Overview

Axios is a promise-based HTTP client for JavaScript applications running in the browser and Node.js. It provides a simple API, flexible request and response interceptors, and built-in support for automatic JSON transformation, request cancellation, and timeouts to simplify communication with APIs and services.

A vulnerability (CVE-2026-44492) has been identified in Axios’s proxy bypass mechanism. Axios uses NO_PROXY to exclude specified hosts from proxy routing. However, its address normalization fails to recognize IPv4-mapped IPv6 addresses as equivalent to their IPv4 counterparts. A request to [::ffff:127.0.0.1] can therefore pass through the configured proxy despite a NO_PROXY=127.0.0.1 exclusion, potentially exposing sensitive traffic.

This unintended request routing maps to CWE-918 (Server-Side Request Forgery), as identified by the Axios advisory. SSRF occurs when attacker-influenced URLs cause a server to make requests to unintended destinations. In Axios, alternate address representations can bypass proxy exclusions, potentially exposing internal requests or sensitive information through an unintended intermediary.

Details

Module Info

• Product: Axios
• Affected packages: axios
• Affected versions: >=1.0.0, <1.16.0; <0.32.0
• GitHub repository: https://github.com/axios/axios
• Published packages: https://www.npmjs.com/package/axios
• Package manager: npm
• Fixed in:
  • NES for Axios 0.24.2
  • OSS Axios v1.15.1
  • OSS Axios v0.31.1

Vulnerability Info

This high-severity vulnerability affects Node.js applications using Axios with a configured HTTP or HTTPS proxy and IPv4-based NO_PROXY exclusions. Axios fails to normalize IPv4-mapped IPv6 addresses before matching those exclusions. The advisory assigns a CVSS v3.1 score of 8.6.

An attacker controlling a request URL can substitute the mapped IPv6 representation of an excluded IPv4 address, causing the request to traverse the proxy. Depending on proxy behavior and service accessibility, this could expose sensitive information, including cloud metadata credentials.

This behavior aligns with CWE-918 (Server-Side Request Forgery), which covers insufficient control over server-side request destinations. Here, the security failure concerns unexpected proxy routing: NO_PROXY specifies destinations that should be contacted directly, rather than blocking access to those destinations. The resulting impact depends on the network environment and the information carried by the request.

Mitigation

Users of affected Axios packages should apply one of the following mitigations:

• Upgrade to a patched version of the axios package.
• Leverage commercial support — HeroDevs provides security support for Axios.