Description
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| axios | axios | >= 1.0.0, < 1.16.0, < 0.32.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-axios | 1.16.0-1 | — |
| Debian 13 | node-axios | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | node-axios | No fix yet | — |
| Ubuntu 25.10 | node-axios | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 26.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 24.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 22.04 LTS | node-axios | No fix yet | — |
| Ubuntu Pro 20.04 LTS | node-axios | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r25 | — |
| Wolfi rolling | kubeflow-centraldashboard | 1.10.0-r22 | — |
| Wolfi rolling | langfuse-3 +1 | 3.177.1-r0 | — |
| Wolfi rolling | lerna | 9.0.7-r7 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.6-r0 | — |
| Wolfi rolling | opensearch-dashboards-3 | 3.6.0-r6 | — |
| Wolfi rolling | prism | 5.15.11-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | axios | >= 1.15.0, < 1.16.0 | 1.16.0 | GHSA-pjwm-pj3p-43mv |
| npm | axios | < 0.32.0 | 0.32.0 | GHSA-pjwm-pj3p-43mv |
Advisories 6
- WID-SEC-2026-3046 IBM Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-2923 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye, und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 8, 2026
- WID-SEC-2026-2460 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 1, 2026
- WID-SEC-2026-1955 Atlassian Bamboo, Bitbucket, Confluence, Fisheye, Crucible, Jira und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2026
- WID-SEC-2026-3307 IBM MQ Appliance (Axios Node.js): Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 22, 2026
- NCSC-2026-0325 Kwetsbaarheden verholpen in Atlassian producten NCSC-NL (Netherlands) · Aug 24, 2026