By weakness (CWE)

CWE-289: related vulnerabilities

CVEs classified under CWE-289. Understanding the weakness class helps prioritize systemic fixes over one-off patches.

1 published vulnerability

• CVE-2026-44492HIGH 8.6

  Axios, a widely-used HTTP client library for JavaScript, contains a bypass vulnerability in its proxy filtering logic. When developers configure Axios to skip the proxy for certain internal IP addresses (via the NO_PROXY setting), an attacker can circumvent that restriction by using an IPv4-mapped IPv6 address format. For example, if 127.0.0.1 is marked as no-proxy, a request to ::ffff:7f00:0:1 still routes through the proxy, potentially exposing internal services. Node.js resolves these IPv6 addresses back to their underlying IPv4 form, so the request reaches the intended internal host while also passing through the proxy infrastructure—defeating the security boundary the no-proxy list was meant to enforce.