CVE catalog
CVE-2026-44492
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1
- Severity
- High · CVSS 8.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 12.28% · Oct 27, 2026
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | node-axios | sid | 1.20.0-1 | fixed |
| Debian | node-axios | forky | 1.20.0-1 | fixed |
| Debian | node-axios | trixie | 1.8.4+dfsg-1 | vulnerable |
| Debian | node-axios | bookworm | 1.2.1+dfsg-1+deb12u1 | not affected |
| Cpe | node-axios | Not reported | Not reported | vulnerable |
| Cpe | axios | Not reported | 0.32.0 | fixed |
| Cpe | axios | Not reported | 1.16.0 | fixed |
| Npm | axios | Not reported | 0.32.0 | fixed |
| Npm | axios | Not reported | 0.32.0 | fixed |
| Cpe | axios | Not reported | 1.16.0 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | node-axios | source | sid | 1.16.0-1 | not yet assigned | Not reported | Not reported |
| Debian | node-axios | source | forky | 1.16.0-1 | not yet assigned | Not reported | Not reported |
| Debian | node-axios | source | trixie | (unfixed) | not yet assigned | Not reported | Not reported |
| Debian | node-axios | source | bookworm | Not affected | unimportant | Not reported | Not reported |
| Cpe | axios | cpe | Not reported | 0.32.0 | Not reported | Not reported | Not reported |
| Cpe | axios | cpe | Not reported | 1.16.0 | Not reported | Not reported | Not reported |
| Npm | axios | npm | Not reported | 0.32.0 | Not reported | GHSA-PJWM-PJ3P-43MV | Not reported |
| Npm | axios | npm | Not reported | 0.32.0 | Not reported | Not reported | Not reported |
| Cpe | axios | cpe | Not reported | 1.16.0 | Not reported | NVD-CVE-2026-44492 | Not reported |
Notes
[trixie] node-axios: Minor issue
OpenFactory catalog packages
[Debian 13 (Trixie)]
- [node-axios]Affected
Details (2)
1.8.4+dfsg-1· all · trixieAffected
nvd · node-axios · debian · 13
1.8.4+dfsg-1· all · trixieAffected
nvd · node-axios · debian · 13
[Debian 12 (Bookworm)]
- [node-axios]Not affected
Details (2)
1.2.1+dfsg-1+deb12u1· all · bookwormNot affected
nvd · node-axios · debian · bookworm
1.2.1+dfsg-1+deb12u1· all · bookwormNot affected
nvd · node-axios · debian · bookworm
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:36754]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-44492]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-44492]
- [https://osv.dev/vulnerability/GHSA-pjwm-pj3p-43mv]
- [https://security-tracker.debian.org/tracker/CVE-2026-44492]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3307.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]