axios CVE-2026-44492

  const LOOPBACK_ADDRESSES = new Set(['localhost', '127.0.0.1', '::1']);
  const isLoopback = (host) => LOOPBACK_ADDRESSES.has(host);

  // normalizeNoProxyHost strips brackets and trailing dots, but not ::ffff: prefix
  return hostname === entryHost || (isLoopback(hostname) && isLoopback(entryHost));

// NO_PROXY=127.0.0.1,localhost,::1  HTTP_PROXY=http://attacker:8080
import shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js';

// All three should return true (bypass proxy). Only the first two do.
console.log(shouldBypassProxy('http://127.0.0.1/'));          // true  [OK]
console.log(shouldBypassProxy('http://[::1]/'));               // true  [OK]
console.log(shouldBypassProxy('http://[::ffff:127.0.0.1]/')); // false <- bypass
console.log(shouldBypassProxy('http://[::ffff:7f00:1]/'));     // false <- bypass

// net.connect({ host: '::ffff:7f00:1', port: 80 }) reaches a service
// bound to 127.0.0.1:80 - confirmed on Node.js v24, Linux and macOS.

const ipv4MappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i;
const ipv4MappedHex    = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;

function hexToIPv4(a, b) {
  const hi = parseInt(a, 16), lo = parseInt(b, 16);
  return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`;
}

const normalizeNoProxyHost = (hostname) => {
  if (!hostname) return hostname;
  if (hostname[0] === '[' && hostname.at(-1) === ']')
    hostname = hostname.slice(1, -1);
  hostname = hostname.replace(/\.+$/, '').toLowerCase();

  let m;
  if ((m = hostname.match(ipv4MappedDotted))) return m[1];
  if ((m = hostname.match(ipv4MappedHex)))    return hexToIPv4(m[1], m[2]);
  return hostname;
};