Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
References
| Link | Resource |
|---|---|
| https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv | Exploit Mitigation Vendor Advisory |
| https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv | Exploit Mitigation Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
13 Jun 2026, 03:16
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv - Exploit, Mitigation, Vendor Advisory |
12 Jun 2026, 19:02
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:axios:axios:*:*:*:*:*:node.js:*:* | |
| First Time |
Axios axios
Axios |
|
| References | () https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv - Exploit, Vendor Advisory, Mitigation |
11 Jun 2026, 17:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-06-11 17:16
Updated : 2026-06-13 03:16
NVD link : CVE-2026-44492
Mitre link : CVE-2026-44492
CVE.ORG link : CVE-2026-44492
JSON object : View
Products Affected
axios
- axios
CWE
CWE-918
Server-Side Request Forgery (SSRF)