CVE Feed

    Dashboard / CVE / CVE-2026-44492

    CVE-2026-44492

    Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.

    Published:Jun 11, 2026
    Last Modified:Sep 3, 2026
    EPS:Jun 11, 2026
    EPSS Score:0.0087
    CVSS Score:8.6

    Affected Products

    Vendor
    Axios
    Product
    Axios

    Exploits

    https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mvhttps://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-664 Server Side Request Forgery

    Related CVEs

    CVE-2026-67321 (CVSS 6.9) — axios versions 0.31.1 before 0.33.0 and 1.15.1 before 1.18.0 contain an incomplete depth-limit bypass in toFor…
    CVE-2026-67318 (CVSS 6.3) — axios versions >=1.13.0 (Node.js HTTP adapter) fail to enforce the configured maxBodyLength limit on streamed …
    CVE-2026-67319 (CVSS 6.3) — axios before 0.33.0 (and 1.x before 1.18.0) can consume inherited properties from nested request option object…
    CVE-2026-67312 (CVSS 6.3) — axios versions from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0 contain uncontrolled recursion in formDa…
    CVE-2026-67315 (CVSS 6.9) — axios versions 0.31.0 before 0.33.0 and 1.15.0 before 1.18.0 fail to recognize 0.0.0.0 as a loopback address i…
    CVE-2026-67316 (CVSS 6.3) — axios is vulnerable to read-side prototype-pollution gadgets that can alter request construction when Object.p…
    CVE-2026-67320 (CVSS 8.3) — axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. …
    CVE-2026-67313 (CVSS 6.3) — axios versions 0.28.0 and later contain uncontrolled recursion in formDataToJSON when processing FormData fiel…
    CVE-2026-67314 (CVSS 6.3) — axios versions >=1.15.2 and <1.18.0 contain prototype-pollution read-side gadgets in Basic auth subfield handl…
    CVE-2026-67317 (CVSS 6.3) — axios versions 1.7.0 before 1.18.0 fail to enforce maxBodyLength for WHATWG ReadableStream request bodies in t…

    References

    https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv
    https://access.redhat.com/errata/RHSA-2026:20889
    https://access.redhat.com/errata/RHSA-2026:20938
    https://access.redhat.com/errata/RHSA-2026:27044
    https://access.redhat.com/errata/RHSA-2026:27063
    https://access.redhat.com/errata/RHSA-2026:28964
    https://access.redhat.com/errata/RHSA-2026:29082
    https://access.redhat.com/errata/RHSA-2026:29197
    https://access.redhat.com/errata/RHSA-2026:30650
    https://access.redhat.com/errata/RHSA-2026:30651
    https://access.redhat.com/errata/RHSA-2026:33005
    https://access.redhat.com/errata/RHSA-2026:33155
    https://access.redhat.com/errata/RHSA-2026:33160
    https://access.redhat.com/errata/RHSA-2026:33163
    https://access.redhat.com/errata/RHSA-2026:33173
    https://access.redhat.com/errata/RHSA-2026:33183
    https://access.redhat.com/errata/RHSA-2026:33574
    https://access.redhat.com/errata/RHSA-2026:34766
    https://access.redhat.com/errata/RHSA-2026:36108
    https://access.redhat.com/errata/RHSA-2026:36611
    https://access.redhat.com/errata/RHSA-2026:36754
    https://access.redhat.com/errata/RHSA-2026:36820
    https://access.redhat.com/errata/RHSA-2026:36882
    https://access.redhat.com/errata/RHSA-2026:36883
    https://access.redhat.com/errata/RHSA-2026:40262
    https://access.redhat.com/errata/RHSA-2026:41031
    https://access.redhat.com/errata/RHSA-2026:41055
    https://access.redhat.com/errata/RHSA-2026:41064
    https://access.redhat.com/errata/RHSA-2026:41066
    https://access.redhat.com/errata/RHSA-2026:41928
    https://access.redhat.com/errata/RHSA-2026:41951
    https://access.redhat.com/errata/RHSA-2026:42078
    https://access.redhat.com/errata/RHSA-2026:42085
    https://access.redhat.com/errata/RHSA-2026:42142
    https://access.redhat.com/errata/RHSA-2026:42146
    https://access.redhat.com/errata/RHSA-2026:42796
    https://access.redhat.com/errata/RHSA-2026:43052
    https://access.redhat.com/errata/RHSA-2026:46885
    https://access.redhat.com/errata/RHSA-2026:46903
    https://access.redhat.com/errata/RHSA-2026:50300
    https://access.redhat.com/errata/RHSA-2026:54188
    https://access.redhat.com/errata/RHSA-2026:57191
    https://access.redhat.com/errata/RHSA-2026:59833
    https://access.redhat.com/errata/RHSA-2026:60520
    https://access.redhat.com/security/cve/CVE-2026-44492
    https://bugzilla.redhat.com/show_bug.cgi?id=2487938
    https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv
    https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High