HTTP Client Vulnerability in Axios for Node.js and Browsers

CVE-2026-44492

What is CVE-2026-44492?

Axios, a widely used promise-based HTTP client for both browsers and Node.js, has a notable vulnerability that arises from its failure to properly normalize IPv4-mapped IPv6 addresses. Specifically, prior to versions 0.32.0 and 1.16.0, the NO_PROXY environment variable, which is intended to prevent requests to specific addresses from being routed through a proxy, does not effectively function when IPv4 addresses, such as 127.0.0.1 or 169.254.169.254, are involved. In these cases, a request using the IPv4-mapped IPv6 format (e.g., ::ffff:7f00:1 or ::ffff:a9fe:a9fe) continues to route through the proxy instead of bypassing it. Given that Node.js translates these addresses to their underlying IPv4 counterparts, this leads to internal services being inadvertently accessed via the proxy, which poses a serious risk to security. This vulnerability has been addressed in the newer versions of Axios.

References