8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44492

CVE-2026-44492: Axios: shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44492

CVE-2026-44492:

8.6

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
axios	npm	>= 1.0.0, < 1.16.0	1.16.0
axios	npm	<= 0.31.1	0.32.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the logic responsible for handling the NO_PROXY environment variable in axios. The core of the issue is in the normalizeNoProxyHost function, which failed to convert IPv4-mapped IPv6 addresses to their standard IPv4 dotted-decimal representation. For instance, an address like ::ffff:127.0.0.1 was not being recognized as 127.0.0.1. Consequently, the main shouldBypassProxy function, which uses normalizeNoProxyHost, would fail to match such an address against a NO_PROXY entry for the corresponding IPv4 address. This flaw could be exploited by an attacker to craft a request URL that bypasses the intended proxy exclusion rules, potentially leading to Server-Side Request Forgery (SSRF) if the proxy is used to access internal network resources that should have been blocked. The patch addresses this by introducing a new function, unmapIPv4MappedIPv6, within lib/helpers/shouldBypassProxy.js to correctly normalize these addresses before the comparison is performed.

Vulnerable functions

normalizeNoProxyHost

lib/helpers/shouldBypassProxy.js

This function was responsible for normalizing hostnames before checking them against the NO_PROXY list. The vulnerability existed because it did not handle IPv4-mapped IPv6 addresses. An attacker could provide a hostname in this format (e.g., `[::ffff:127.0.0.1]`) which would not be correctly normalized to its IPv4 equivalent (`127.0.0.1`), thus bypassing the proxy exclusion rule. The patch fixes this by introducing `unmapIPv4MappedIPv6` to perform this normalization.

shouldBypassProxy

lib/helpers/shouldBypassProxy.js

This is the main function that determines whether a request should bypass the proxy. It was vulnerable because it relied on the flawed output of `normalizeNoProxyHost`. When `shouldBypassProxy` processed a URL containing an IPv4-mapped IPv6 address, it would incorrectly decide to use the proxy instead of bypassing it, allowing an attacker to circumvent network policies defined in `NO_PROXY` and potentially cause a Server-Side Request Forgery (SSRF) vulnerability.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.