CVE-2026-44492 axios CVE debrief

Who should care

Node.js developers and administrators using Axios for HTTP requests, especially in environments with proxy configurations, should assess exposure and plan mitigations. They should verify if current versions are vulnerable and plan for upgrades to 0.32.0 or 1.16.0. Implement compensating controls like stricter proxy rules or monitor for suspicious traffic. Defenders should prioritize assessing exposure in Node.js environments using Axios for HTTP requests,

Why it matters

CVE-2026-44492 in Axios allows requests to bypass NO_PROXY settings, potentially exposing internal services to unauthorized access. Defenders should assess exposure, prioritize upgrades, and implement compensating controls.

• Verify proxy configurations to prevent unintended exposure of internal services.
• Assess and upgrade Axios versions to prevent potential proxy bypass.
• Monitor traffic for suspicious activity that could indicate exploitation attempts.
• Implement additional security controls like stricter access controls for internal services.

Technical summary

Axios does not normalize IPv4-mapped IPv6 addresses, leading to potential proxy bypass when NO_PROXY lists an IPv4 address. Fixed in Axios versions 0.32.0 and 1.16.0. This issue allows internal services to be accessed via the proxy, potentially bypassing intended blocking. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. The vulnerability is fixed in 0.32.0 and 1.16.0. Axios, a promise-based HTTP client for browser and Node.js, has a vulnerability prior to versions 0.32.0 and 1.16.0.

Defensive priority

Defenders should prioritize assessing exposure in Node.js environments using Axios for HTTP requests, especially where proxy configurations are used. Verify if current versions are vulnerable and plan for upgrades to 0.32.0 or 1.16.0. Implement compensating controls like stricter proxy rules or monitor for suspicious traffic.

Recommended defensive actions

• Assess Node.js environments for Axios usage and potential exposure.
• Verify current Axios versions and plan upgrades to 0.32.0 or 1.16.0.
• Implement stricter proxy rules or monitor for suspicious traffic as compensating controls.
• Review proxy configurations to prevent unintended exposure of internal services.
• Assess and upgrade Axios versions to prevent potential proxy bypass.
• Monitor traffic for suspicious activity that could indicate exploitation attempts.
• Implement additional security controls like stricter access controls for internal services.

Evidence notes

The CVE record and NVD details provide information on the vulnerability in Axios. Vendor advisories and errata from Red Hat offer additional context and mitigation strategies. Axios does not normalize IPv4-mapped IPv6 addresses, leading to potential proxy bypass when NO_PROXY lists an IPv4 address. This issue allows internal services to be accessed via the proxy, potentially bypassing intended blocking. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than  

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.