Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
| Date | Total | Labels |
|---|
| 2026-05-29 | 1 | Disclosure1 |
| 2026-06-11 | 1 | General1 |
CVE-2026-44492 Proxy Bypass via IPv4-Mapped IPv6 Address Normalization in Axios https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-44492
Post summary
A brief mention of CVE‑2026‑44492 describing a proxy bypass in Axios via IPv4‑mapped IPv6 normalization; no further technical detail, exploit, patch, or active exploitation information is provided.
🚨 High - Two axios Security Flaws Disclosed (CVE-2026-44492 & CVE-2026-44494) Two high-severity vulnerabilities in axios (npm) were published today, both enabling network-level attacks by abusing proxy handling logic: axios NO_PROXY Bypass via IPv4-mapped IPv6 (CVE-2026-44492, CVSS 8.6) — shouldBypassProxy (introduced in v1.15.0 to fix CVE-2025-62718) fails to normalize IPv4-mapped IPv6 addresses like ::ffff:169.254.169.254. When NO_PROXY blocks 169.254.169.254, a request to its IPv6-mapped form still routes through the proxy, enabling cloud metadata SSRF against IMDS endpoints. axios Prototype Pollution → Full MITM via config.proxy (CVE-2026-44494, CVSS 9.4) — Because proxy is absent from axios defaults, the merged config object has no own proxy property. Any Object.prototype pollution in the dependency tree (e.g. via qs, minimist) can inject a malicious proxy into all axios HTTP requests, intercepting credentials, auth tokens, and response data with no user interaction and no visible indication. 👉 Affected: axios (npm) ≥ 1.0.0 < 1.16.0 and ≤ 0.31.1 | Upgrade to 1.16.0 / 0.32.0
Post summary
The tweet announces two high‑severity axios vulnerabilities (CVE‑2026‑44492 and CVE‑2026‑44494) and recommends upgrading to patched releases 1.16.0 or 0.32.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | axios | axios | - | node.js | - |