When NO_PROXY Lies: Finding an IPv4-Mapped IPv6 Patch Bypass in Axios

In this talk, I’ll walk through how I analyzed a security fix in Axios and found that the patch still left a bypass route open through IPv4-mapped IPv6 addresses. The original issue had already taught Axios to normalize some hostname edge cases for NO_PROXY, but the fix still relied on string comparisons after partial normalization. That left a gap where the same host could be represented differently enough to evade policy checks.

I’ll show how this happens in practice, why the Node/WHATWG URL stack turns mapped addresses into canonical IPv6 forms, and how that breaks exact NO_PROXY matching in a way that is easy to miss during patch review. The session will include a small, reproducible demo using a local proxy and a safe local target, and then walk through the remediation strategy to properly close the issue.

This is a case study in patch-bypass hunting for open-source software, reviewing a fix, reasoning about representation mismatches, and turning a tiny edge case into a maintainable engineering lesson for security-sensitive code.

The GHSA I reported has been accepted and fixed in the latest Axios. GitHub has issued CVE-2026-44492.

Ref. link: https://github.com/advisories/GHSA-pjwm-pj3p-43mv

1. How NO_PROXY, URL parsing, and host canonicalization interact in Node.js applications
2. Why IPv4-mapped IPv6 is a practical security problem and not just a formatting oddity
3. A repeatable methodology for finding patch bypasses by reviewing what a fix normalized and what it still compared as raw text
4. Concrete lessons maintainers can apply when enforcing network policy in OSS libraries