axios's shouldBypassProxy does not recognize IPv4-mapped IPv6 addresses, allowing NO_PROXY bypass (incomplete fix for CVE-2025-62718)

🗓️ 29 May 2026 15:59:30Reported by GitHub Advisory DatabaseType

Axios shouldBypassProxy v1.15.0 fails to normalize IPv4-mapped IPv6 addresses, breaking NO_PROXY.

Reporter	Title	Published	Views	Family All 109
IBM Security Bulletins	Security Bulletin: SPSS Collaboration and Deployment Services is affected by multiple vulnerabilities in Axios	14 Jul 202619:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM z/TPF Development is affected by multiple vulnerabilities	9 Jul 202618:53	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with a known vulnerability (CVE-2026-44486, CVE-2026-44487, CVE-2026-44488, CVE-2026-44489, CVE-2026-44490, CVE-2026-44492, CVE-2026-44494, CVE-2026-44496)	24 Jul 202616:32	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MAS uses axios-1.15.2, protobufjs-8.0.1 and undici-7.26 which is vulnerable to multiple CVEs, and contains vulnerabilities related to missing Secure attribute on mas-redirect-uri cookie and weak HMAC Session Secret	3 Aug 202611:18	–	ibm
Atlassian	SSRF (Server-Side Request Forgery) axios Dependency in Bamboo Data Center	11 Jun 202617:30	–	atlassian
Atlassian	SSRF (Server-Side Request Forgery) axios Dependency in Bitbucket Data Center	11 Jun 202617:30	–	atlassian
Atlassian	SSRF (Server-Side Request Forgery) axios Dependency in Confluence Data Center	11 Jul 202604:30	–	atlassian
BDU FSTEC	The vulnerability of the lib/helpers/shouldBypassProxy.js file in the axios library allows a hacker to bypass existing security restrictions.	3 Jun 202600:00	–	bdu_fstec
Chainguard	CVE-2026-44492 vulnerabilities	1 Jun 202619:18	–	cgr
Circl	CVE-2026-44492	29 May 202606:32	–	circl

Vulners

Node

axios axiosRange1.15.0–1.16.0npm

axios axiosRange≤0.31.1npm

Source	Link
github	www.github.com/axios/axios/security/advisories/GHSA-pjwm-pj3p-43mv
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-62718
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-44492
security	www.security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44492.json
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
access	www.access.redhat.com/security/cve/CVE-2026-44492
access	www.access.redhat.com/errata/RHSA-2026:36108
access	www.access.redhat.com/errata/RHSA-2026:33574
access	www.access.redhat.com/errata/RHSA-2026:33183
access	www.access.redhat.com/errata/RHSA-2026:33173

20 Jul 2026 12:34Current

7.3High risk

Vulners AI Score7.3

CVSS 3.18.6

EPSS0.0087

SSVC