I’ll explain how I analyzed a security fix in Axios and found a bypass route via IPv4-mapped IPv6 addresses. The patch normalized hostname edge cases for NO_PROXY but relied on string comparisons, leaving a gap where hosts could be represented differently. I’ll demonstrate how this occurs, why URL normalization affects NO_PROXY matching, and how to fix it. The case study highlights patch-bypass hunting and secure coding practices. Issue fixed in Axios: CVE-2026-44492 - public on June 15, 2026.