Skip to main content

axios EUVDEUVD-2026-36255

| CVE-2026-44492 HIGH
Server-Side Request Forgery (SSRF) (CWE-918)
2026-05-29 https://github.com/axios/axios GHSA-pjwm-pj3p-43mv
SSRF Node.js Apple
8.6
CVSS 3.1 · Vendor: https://github.com/axios/axios
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Recon
    Identify endpoint accepting user-supplied URL
  2. Delivery
    Craft IPv4-mapped IPv6 target (::ffff:a9fe:a9fe)
  3. Exploit
    Submit URL to vulnerable axios caller
  4. Install
    shouldBypassProxy returns false, proxy is used
  5. C2
    Proxy forwards request, Node resolves to 169.254.169.254
  6. Execute
    Receive IMDS credentials in response
  7. Impact
    Exfiltrate credentials for lateral cloud access

Vulnerability Assessment

Weakness
CWE
CWE-918
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK

2 techniques across 2 tactics: Initial Access, Credential Access

The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up.

Sign in to read
Exploitation Conditions

Exploitation requires all of: (1) a server-side Node.js application using axios in the vulnerable range (>=1.0.0 <1.16.0 or <=0.31.1); (2) HTTP_PROXY or HTTPS_PROXY environment variable set so that axios actually consults shouldBypassProxy; (3) NO_PROXY configured with an IPv4 literal (e.g., 127.0.0.1, 169.254.169.254, or an internal RFC1918 address) that the application relies on to protect an internal target; (4) attacker control over the request URL passed to axios - typically through a user-supplied parameter to a fetch/webhook/preview feature. Limiting factors: browser-side axios is not affected because it does not honour proxy env vars; deployments without an egress proxy are not affected; IMDSv2-only AWS environments mitigate the most damaging cloud-metadata variant because token negotiation still fails; and applications that strictly validate URLs (rejecting bracketed IPv6 or non-allowlisted hosts) before passing them to axios are out of scope.
Impact

The CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N vector (8.6 High) reflects that exploitation is network-reachable, requires no privileges or user interaction, and crosses a trust boundary (scope changed) to disclose data - fitting the SSRF-to-metadata theft scenario described. Real-world risk is meaningful but conditional: an exploitable deployment must (a) use axios as a server-side HTTP client, (b) set HTTP(S)_PROXY pointing somewhere the attacker can observe or control, (c) rely on NO_PROXY to protect an internal/metadata target, and (d) accept attacker-influenced URLs. Where those conditions hold (notably cloud workloads using egress proxies plus IMDSv1), impact is high - credential theft via 169.254.169.254 is realistic. No EPSS score, KEV listing, or SSVC decision is supplied; treat exploitation likelihood as unknown but the publicly published PoC and trivial payload (a single URL substitution) mean weaponisation cost is low. Because patch and PoC are public simultaneously and the bug is a re-break of CVE-2025-62718, expect scanners and supply-chain advisories to flag it quickly.
Exploit ScenarioDerived

An attacker submits a URL parameter like http://[::ffff:a9fe:a9fe]/latest/meta-data/iam/security-credentials/ to a server-side feature (webhook tester, image fetcher, OpenGraph preview, etc.) that uses axios with HTTP_PROXY set and NO_PROXY=169.254.169.254. axios's shouldBypassProxy fails to match the IPv4-mapped IPv6 form against the IPv4 entry, so the request is sent through the attacker-controlled or attacker-observable proxy, which forwards it and - because Node resolves ::ffff:a9fe:a9fe to 169.254.169.254 - returns the EC2 instance role credentials. A working PoC is published in the GHSA advisory.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 29, 2026

Server-Side Request Forgery in axios versions <1.16.0 and <=0.31.1 allows remote attackers who control a request URL to bypass NO_PROXY allowlists by using IPv4-mapped IPv6 notation (e.g., ::ffff:7f00:1 for 127.0.0.1, or ::ffff:a9fe:a9fe for the 169.254.169.254 cloud metadata endpoint). The flaw is an incomplete fix for CVE-2025-62718: shouldBypassProxy normalizes brackets and trailing dots but never canonicalises the ::ffff: prefix, so loopback and metadata exclusions silently fail and traffic is routed through an attacker-controlled HTTP/HTTPS proxy. Publicly available exploit code exists (full PoC in the GHSA advisory); no public exploit identified at time of analysis as actively exploited and the CVE is not in CISA KEV.

RemediationAI

Vendor-released patch: upgrade axios to 1.16.0 (1.x line) or 0.32.0 (0.x line) per GHSA-pjwm-pj3p-43mv at https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv; the fix canonicalises ::ffff: IPv4-mapped IPv6 hostnames in normalizeNoProxyHost before comparison. If immediate upgrade is not possible, compensating controls include: enforce IMDSv2 on AWS (requires a session token, blocking the SSRF-to-metadata path even if the proxy bypass succeeds, with the side effect that any legacy SDK/tool relying on IMDSv1 must be updated); block outbound traffic to 169.254.169.254 and other sensitive internal ranges at the egress proxy itself rather than relying on client-side NO_PROXY (side effect: legitimate metadata calls must use an allowlisted path); validate or normalise user-controlled URLs before passing them to axios by rejecting bracketed IPv6 hosts or resolving and re-checking the destination IP against a denylist (side effect: breaks legitimate IPv6 use cases); or pin egress-proxy ACLs so the proxy refuses to forward to RFC1918, link-local, and loopback ranges regardless of what the client requests.

Affected VersionsENISA

axios < 0.32.0
axios 1.0.0, < 1.16.0

Affected Packages

npm axios fix: 0.32.0, 1.16.0

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

axios is one of the most widely deployed HTTP client libraries in the Node.js ecosystem (pkg:npm/axios). Proxy selection in Node.js is governed by the HTTP_PROXY/HTTPS_PROXY and NO_PROXY environment variables; axios layers its own shouldBypassProxy on top of proxy-from-env to decide whether to send a request directly or through a proxy. The root cause maps to CWE-918 (Server-Side Request Forgery): both layers perform a string-equality check between hostname and NO_PROXY entries, but the WHATWG URL parser canonicalises hostnames like [::ffff:127.0.0.1] to [::ffff:7f00:1], producing a string that does not equal 127.0.0.1. Node's net stack, however, transparently resolves IPv4-mapped IPv6 destinations back to the underlying IPv4 socket, so the proxy ultimately delivers traffic to the very internal address NO_PROXY was meant to exclude. This is a classic input-canonicalisation gap where the security check operates on a different representation than the eventual network operation.

Know when Node.js gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (https://github.com/axios/axios) PRIMARY 8.6 HIGH
AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
SUSE HIGH
Red Hat 8.6 HIGH

Primary rating from Vendor (https://github.com/axios/axios).

CVSS VectorVendor: https://github.com/axios/axios

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
None
Availability
None

DescriptionCVE.org

Summary

shouldBypassProxy, introduced in v1.15.0 to fix CVE-2025-62718, does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked.

Details

lib/helpers/shouldBypassProxy.js (v1.15.0):

javascript
  const LOOPBACK_ADDRESSES = new Set(['localhost', '127.0.0.1', '::1']);
  const isLoopback = (host) => LOOPBACK_ADDRESSES.has(host);

  // normalizeNoProxyHost strips brackets and trailing dots, but not ::ffff: prefix
  return hostname === entryHost || (isLoopback(hostname) && isLoopback(entryHost));

The WHATWG URL parser canonicalises http://[::ffff:127.0.0.1]/ to hostname [::ffff:7f00:1]. After bracket-stripping: ::ffff:7f00:1. This string does not match 127.0.0.1 in NO_PROXY and is not in LOOPBACK_ADDRESSES, so shouldBypassProxy returns false and the proxy is used. proxy-from-env (called before shouldBypassProxy) has the same gap - it does not equate ::ffff:7f00:1 with 127.0.0.1 - so neither layer catches the bypass.

PoC

javascript

// NO_PROXY=127.0.0.1,localhost,::1  HTTP_PROXY=http://attacker:8080
import shouldBypassProxy from 'axios/lib/helpers/shouldBypassProxy.js';

// All three should return true (bypass proxy). Only the first two do.
console.log(shouldBypassProxy('http://127.0.0.1/'));          // true  [OK]
console.log(shouldBypassProxy('http://[::1]/'));               // true  [OK]
console.log(shouldBypassProxy('http://[::ffff:127.0.0.1]/')); // false <- bypass
console.log(shouldBypassProxy('http://[::ffff:7f00:1]/'));     // false <- bypass

Node.js routes ::ffff:7f00:1 to 127.0.0.1:

// net.connect({ host: '::ffff:7f00:1', port: 80 }) reaches a service
// bound to 127.0.0.1:80 - confirmed on Node.js v24, Linux and macOS.

Cloud metadata SSRF: ::ffff:a9fe:a9fe = ::ffff:169.254.169.254. If NO_PROXY=169.254.169.254 is set to block IMDS access, a request to http://[::ffff:a9fe:a9fe]/latest/meta-data/ bypasses it.

Fix

Canonicalise IPv4-mapped IPv6 in normalizeNoProxyHost before any comparison:

javascript
const ipv4MappedDotted = /^::ffff:(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})$/i;
const ipv4MappedHex    = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i;

function hexToIPv4(a, b) {
  const hi = parseInt(a, 16), lo = parseInt(b, 16);
  return `${hi >> 8}.${hi & 0xff}.${lo >> 8}.${lo & 0xff}`;
}

const normalizeNoProxyHost = (hostname) => {
  if (!hostname) return hostname;
  if (hostname[0] === '[' && hostname.at(-1) === ']')
    hostname = hostname.slice(1, -1);
  hostname = hostname.replace(/\.+$/, '').toLowerCase();

  let m;
  if ((m = hostname.match(ipv4MappedDotted))) return m[1];
  if ((m = hostname.match(ipv4MappedHex)))    return hexToIPv4(m[1], m[2]);
  return hostname;
};

Impact

Any application that sets NO_PROXY to exclude internal or metadata endpoints and uses an HTTP/HTTPS proxy can have those exclusions bypassed by a URL using IPv4-mapped IPv6 notation. The attacker must control the request URL. In cloud environments with instance metadata services, this can lead to credential exfiltration.

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 3,089 npm packages depend on axios (826 direct, 2,289 indirect)

Ecosystem-wide dependent count for version 1.15.0.

Executive ViewAI

Why It Matters

A Server-Side Request Forgery (SSRF) vulnerability affecting axios versions before 1.16.0 enables remote attackers to bypass proxy allowlist controls using IPv4-mapped IPv6 notation, with publicly available exploit code. This creates immediate risk for organizations using axios in server-side applications, potentially exposing internal systems and cloud metadata endpoints. The combination of exploit availability and widespread axios usage elevates this to a critical supply chain risk.

Business Impact: High
Compensating Controls

Restrict network access from application servers to internal systems and cloud metadata endpoints (169.254.169.254) using firewall rules; implement strict outbound proxy validation at network boundary; deploy WAF rules to block IPv6-mapped IPv4 notation patterns; limit IAM role permissions to minimum required; establish comprehensive logging and monitoring of outbound proxy activity and internal endpoint access attempts.

Threat Intelligence Overview

EPSS Score
0.0%
Top 90% exploitable
Threat Intel
1
1 source
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Out-of-Cycle
Exploitation
Poc
System Exposure· derived
Open
Automatable
Yes
Human Impact
High
Technical Impact
Partial

Priority Score

43
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +43
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Server-Side Request Forgery HIGH

Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.

More in Node.js

View all
CVE-2025-68613 HIGH POC
8.8 Dec 19

Remote code execution in n8n's workflow expression evaluation system allows an authenticated user with workflow creation
CVE-2024-41713 CRITICAL POC
9.1 Oct 21

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could
CVE-2024-55591 CRITICAL POC
9.8 Jan 14

FortiOS and FortiProxy contain an authentication bypass via the Node.js websocket module allowing unauthenticated remote
CVE-2023-44487 HIGH POC
7.5 Oct 10

Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
CVE-2014-7205 CRITICAL POC
10.0 Oct 08

Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for t
CVE-2025-59528 CRITICAL POC
10.0 Sep 22

Flowise version 3.0.5 contains a remote code execution vulnerability in the CustomMCP node. The mcpServerConfig paramete
CVE-2017-14849 HIGH POC
7.5 Sep 28

Node.js 8.5.0 before 8.6.0 allows remote attackers to access unintended files, because a change to ".." handling was inc
CVE-2017-5941 CRITICAL POC
9.8 Feb 09

An issue was discovered in the node-serialize package 0.0.4 for Node.js. Rated critical severity (CVSS 9.8), this vulner
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2014-3744 HIGH POC
7.5 Oct 23

Directory traversal vulnerability in the st module before 0.2.5 for Node.js allows remote attackers to read arbitrary fi
CVE-2014-9566 HIGH POC
7.5 Mar 10

Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwin
CVE-2024-35286 CRITICAL POC
9.8 Oct 21

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to cond

Same weakness CWE-918 – Server-Side Request Forgery (SSRF)

View all
CVE-2021-34473 CRITICAL POC
9.1
CVE-2021-26855 CRITICAL POC
9.1
CVE-2021-21985 CRITICAL POC
9.8
CVE-2022-41040 HIGH POC
8.8
CVE-2024-21893 HIGH POC
8.2
CVE-2021-40438 CRITICAL POC
9.0
CVE-2021-22054 HIGH POC
7.5
CVE-2021-21975 HIGH POC
7.5

Same technique SSRF

View all
CVE-2016-3718 MEDIUM POC
5.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise Module for Python 3 15 SP7 Not-Affected
SUSE Linux Enterprise Module for SAP Applications 15 SP7 Not-Affected
SUSE Linux Enterprise Server 15 SP7 Not-Affected

References

Advisories & patches
ADVISORY https://github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv ADVISORY https://vuldb.com/vuln/370405 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-44492 REF https://access.redhat.com/errata/RHSA-2026:20889 REF https://access.redhat.com/errata/RHSA-2026:20938 REF https://access.redhat.com/errata/RHSA-2026:26234 REF https://access.redhat.com/errata/RHSA-2026:27044 REF https://access.redhat.com/errata/RHSA-2026:27063 REF https://access.redhat.com/errata/RHSA-2026:28964 REF https://access.redhat.com/errata/RHSA-2026:29082 REF https://access.redhat.com/errata/RHSA-2026:29197 REF https://access.redhat.com/errata/RHSA-2026:30650 REF https://access.redhat.com/errata/RHSA-2026:30651 REF https://access.redhat.com/errata/RHSA-2026:33005 REF https://access.redhat.com/errata/RHSA-2026:33155 REF https://access.redhat.com/errata/RHSA-2026:33160 REF https://access.redhat.com/errata/RHSA-2026:33163 REF https://access.redhat.com/errata/RHSA-2026:33173 REF https://access.redhat.com/errata/RHSA-2026:33183 REF https://access.redhat.com/errata/RHSA-2026:33574 REF https://access.redhat.com/errata/RHSA-2026:34766 REF https://access.redhat.com/errata/RHSA-2026:36108 REF https://access.redhat.com/errata/RHSA-2026:36611 REF https://access.redhat.com/errata/RHSA-2026:36754 REF https://access.redhat.com/errata/RHSA-2026:36820 REF https://access.redhat.com/errata/RHSA-2026:36882 REF https://access.redhat.com/errata/RHSA-2026:36883 REF https://access.redhat.com/errata/RHSA-2026:40119 REF https://access.redhat.com/errata/RHSA-2026:40138 REF https://access.redhat.com/errata/RHSA-2026:40262 REF https://access.redhat.com/errata/RHSA-2026:41031 REF https://access.redhat.com/errata/RHSA-2026:41055 REF https://access.redhat.com/errata/RHSA-2026:41064 REF https://access.redhat.com/errata/RHSA-2026:41066 REF https://access.redhat.com/errata/RHSA-2026:41928 REF https://access.redhat.com/errata/RHSA-2026:41951 REF https://access.redhat.com/errata/RHSA-2026:42078 REF https://access.redhat.com/errata/RHSA-2026:42085 REF https://access.redhat.com/errata/RHSA-2026:42142 REF https://access.redhat.com/errata/RHSA-2026:42146 REF https://access.redhat.com/errata/RHSA-2026:42796 REF https://access.redhat.com/errata/RHSA-2026:43052 REF https://access.redhat.com/errata/RHSA-2026:46885 REF https://access.redhat.com/errata/RHSA-2026:46903 REF https://access.redhat.com/errata/RHSA-2026:50300 REF https://access.redhat.com/errata/RHSA-2026:54188 REF https://access.redhat.com/errata/RHSA-2026:57191 REF https://access.redhat.com/errata/RHSA-2026:59833 REF https://access.redhat.com/errata/RHSA-2026:60520 REF https://access.redhat.com/errata/RHSA-2026:66488 REF https://access.redhat.com/errata/RHSA-2026:66545 REF https://access.redhat.com/security/cve/CVE-2026-44492 REF https://bugzilla.redhat.com/show_bug.cgi?id=2487938 REF https://github.com/advisories/GHSA-pjwm-pj3p-43mv REF https://nvd.nist.gov/vuln/detail/CVE-2025-62718 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy