CVE-2026-44492
HIGH 8.6Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NO_PROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Severe if exploited (CVSS 8.6), but no known exploitation and low modeled probability. Patch on a normal cadence.
Exploitation likelihood
0.9%chance of exploitation in 30 days · 56th percentile
Impact if exploited
8.6CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityNone
- AvailabilityNone
What an attacker needs
- ✓Access: Reachable over the network — no local access needed
- ✓Privileges: No account or privileges required
- ✓User interaction: No user interaction needed
- ✓Complexity: No special conditions — reliably repeatable
✓ lowers the bar for an attacker · ⚠ raises it
Affected
Products Axios Red Hat Advanced Cluster Management For Kubernetes 2.13 Red Hat Advanced Cluster Security For Kubernetes 4.10 Red Hat Container Native Virtualization 4.14 Red Hat Developer Hub 1.9 Red Hat Discovery 2 Red Hat Openshift Container Platform 4.16 Red Hat Openshift Container Platform 4.20
Weakness (CWE)
- CWE-918: Server-side request forgery (SSRF)
- CWE-289
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
References
Advisories
- https://access.redhat.com/errata/RHSA-2026:30651
- https://access.redhat.com/errata/RHSA-2026:20889
- https://access.redhat.com/errata/RHSA-2026:33005
- https://access.redhat.com/errata/RHSA-2026:33574
- https://access.redhat.com/errata/RHSA-2026:26234
- https://access.redhat.com/errata/RHSA-2026:29197
- https://access.redhat.com/errata/RHSA-2026:29082
- https://access.redhat.com/errata/RHSA-2026:27063