Executive brief
Axios is a widely used tool for making web requests in applications. A security flaw allows attackers to bypass safety rules that are supposed to prevent the application from connecting to sensitive internal services or private cloud data. This could lead to the theft of secret credentials or unauthorized access to internal company systems.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in Axios due to improper normalization of IPv4-mapped IPv6 addresses in the 'shouldBypassProxy' helper. When a 'NO_PROXY' list contains an IPv4 address (e.g., 127.0.0.1), an attacker can provide a URL using the equivalent IPv6-mapped format (e.g., ::ffff:7f00:1). Because Axios does not recognize these as identical, it routes the request through the configured proxy instead of bypassing it. Node.js then resolves these addresses to the underlying IPv4 host, allowing the request to reach internal services or cloud metadata endpoints (IMDS). This is an incomplete fix for a previous vulnerability and is resolved in versions 0.32.0 and 1.16.0.
Affected products
- Axios Axios >= 1.0.0, < 1.16.0; < 0.32.0
Timeline
- 2026-05-29: advisory: GitHub advisory published by maintainers
- 2026-06-11: disclosed: CVE-2026-44492 published to NVD