REDHAT-BUG-2487938: High severity npm/axios vulnerability
Axios is a promise based HTTP client for the browser and Node.js. Prior to 0.32.0 and 1.16.0, Axios does not normalise IPv4-mapped IPv6 addresses. When NOPROXY lists an IPv4 address such as 127.0.0.1 or 169.254.169.254, a request URL using the IPv4-mapped IPv6 form (::ffff:7f00:1, ::ffff:a9fe:a9fe) still routes through the configured proxy. Node.js resolves these addresses to the underlying IPv4 host, so the request reaches the internal service via the proxy rather than being blocked. This vulnerability is fixed in 0.32.0 and 1.16.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 0.32.0 - Upgrade
Upgrade
axiosto a version that resolves this vulnerability.Fixed in 1.16.0
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2487938?
The severity of REDHAT-BUG-2487938 is classified as high with a score of 7.
How do I fix REDHAT-BUG-2487938?
To fix REDHAT-BUG-2487938, update Axios to version 0.32.0 or higher for npm/axios.
What impact does REDHAT-BUG-2487938 have on my application?
REDHAT-BUG-2487938 can lead to improper handling of IPv4-mapped IPv6 addresses, potentially causing connectivity issues.
Which versions of Axios are affected by REDHAT-BUG-2487938?
Versions prior to 0.32.0 and 1.16.0 of Axios are affected by REDHAT-BUG-2487938.
When was REDHAT-BUG-2487938 published?
REDHAT-BUG-2487938 was published on June 11, 2026.