From b19633ffd74aab9670e929c0f9b5d3e56d3505f5 Mon Sep 17 00:00:00 2001
From: Nikita Snetkov <lukyanish@gmail.com>
Date: Fri, 28 Aug 2026 17:35:11 +0500
Subject: [PATCH 1/5] http: match subdomains for plain NO_PROXY entries

NO_PROXY=example.com only exact-matched the hostname in the
http(s) builtins, so requests to subdomains still used the proxy.
fetch() already matches the host and its subdomains.

Reuse the existing suffix matcher (label boundary) for plain
entries as well as leading-dot ones.

Fixes: https://github.com/nodejs/node/issues/65616
Assisted-by: Grok 4.6 Extra High
Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
---
 doc/api/http.md                               |  2 +-
 lib/internal/http.js                          |  7 ++--
 ...est-http-proxy-request-no-proxy-domain.mjs | 39 ++++++++++++++++++-
 3 files changed, 43 insertions(+), 5 deletions(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index 4c1c5ad1321a..c2c86eb76822 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -4615,7 +4615,7 @@ Proxy URLs can use either HTTP or HTTPS protocols:
 The `NO_PROXY` environment variable supports several formats:
 
 * `*` - Bypass proxy for all hosts
-* `example.com` - Exact host name match
+* `example.com` - Host and subdomain match (matches `sub.example.com`)
 * `.example.com` - Domain suffix match (matches `sub.example.com`)
 * `*.example.com` - Wildcard domain match
 * `192.168.1.100` - Exact IP address match
diff --git a/lib/internal/http.js b/lib/internal/http.js
index 304ef04d6638..75e9fe4e8547 100644
--- a/lib/internal/http.js
+++ b/lib/internal/http.js
@@ -163,9 +163,10 @@ class ProxyConfig {
       if (entry === '*') return false;  // * bypasses all hosts.
       if (entry === host || entry === hostWithPort) return false;  // Matching host and host:port
 
-      // Follow curl's behavior: strip leading dot before matching suffixes.
-      if (entry[0] === '.') {
-        const suffix = entry.substring(1);
+      // Strip a leading "." if present, then match as a suffix with a
+      // label boundary. "*.example.com" is handled below (subdomains only).
+      if (!entry.startsWith('*.')) {
+        const suffix = entry[0] === '.' ? entry.substring(1) : entry;
         if (host === suffix || (host.endsWith(suffix) && host[host.length - suffix.length - 1] === '.')) return false;
       }
 
diff --git a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
index 1863f3bc94b2..c43032281705 100644
--- a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
+++ b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
@@ -10,7 +10,7 @@ import { runProxiedRequest } from '../common/proxy-server.js';
 const server = http.createServer(common.mustCall((req, res) => {
   res.writeHead(200, { 'Content-Type': 'text/plain' });
   res.end('Hello World\n');
-}, 5));
+}, 7));
 server.on('error', common.mustNotCall((err) => { console.error('Server error', err); }));
 server.listen(0, '127.0.0.1');
 await once(server, 'listening');
@@ -78,6 +78,43 @@ await once(proxy, 'listening');
   assert.strictEqual(signal, null);
 }
 
+{
+  // Test NO_PROXY with a plain domain also matching subdomains.
+  const { code, signal, stderr, stdout } = await runProxiedRequest({
+    NODE_USE_ENV_PROXY: 1,
+    REQUEST_URL: `http://test.example.com:${server.address().port}/test`,
+    HTTP_PROXY: `http://localhost:${proxy.address().port}`,
+    RESOLVE_TO_LOCALHOST: 'test.example.com',
+    NO_PROXY: 'example.com',
+  });
+
+  // The request should succeed and bypass proxy.
+  assert.match(stdout, /Status Code: 200/);
+  assert.match(stdout, /Hello World/);
+  assert.match(stdout, /Resolving lookup for test\.example\.com/);
+  assert.strictEqual(stderr.trim(), '');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+{
+  // Test NO_PROXY with a plain domain should NOT match partial domain names.
+  const { code, signal, stderr, stdout } = await runProxiedRequest({
+    NODE_USE_ENV_PROXY: 1,
+    REQUEST_URL: `http://badexample.com:${server.address().port}/test`,
+    HTTP_PROXY: `http://localhost:${server.address().port}`,
+    RESOLVE_TO_LOCALHOST: 'badexample.com',
+    NO_PROXY: 'example.com',
+  });
+
+  // The request should go through the proxy (not bypass it),
+  // because badexample.com is not a subdomain of example.com.
+  assert.match(stdout, /Status Code: 200/);
+  assert.strictEqual(stderr.trim(), '');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
 // Test NO_PROXY with leading-dot entry should NOT match partial domain names.
 // Regression test: .example.com must not match notexample.com or badexample.com.
 {

From 734e21befa42215be9a91993b56fff773aa4a5e7 Mon Sep 17 00:00:00 2001
From: Nikita Snetkov <lukyanish@gmail.com>
Date: Tue, 1 Sep 2026 11:09:16 +0500
Subject: [PATCH 2/5] fixup! http: match subdomains for plain NO_PROXY entries

Limit NO_PROXY suffix matching to domain entries and domain hosts:

- drop empty entries (e.g. from trailing commas) at parse time, so
  they can no longer match hostnames ending with a dot
- IP entries only match a host exactly; IP hosts can only be bypassed
  by exact IP, IP:port, or IP range entries
- degenerate "." and "*." entries no longer match every host ending
  with a dot

Assisted-by: Claude Fable 5
Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
---
 doc/api/http.md                               | 13 ++-
 lib/internal/http.js                          | 27 +++++--
 ...est-http-proxy-request-no-proxy-domain.mjs | 79 ++++++++++++++++++-
 ...-http-proxy-request-no-proxy-ip-suffix.mjs | 65 +++++++++++++++
 4 files changed, 175 insertions(+), 9 deletions(-)
 create mode 100644 test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs

diff --git a/doc/api/http.md b/doc/api/http.md
index c2c86eb76822..6e6fd9020bd6 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -4559,6 +4559,11 @@ A browser-compatible implementation of {WebSocket}.
 added:
  - v24.5.0
  - v22.21.0
+changes:
+  - version: REPLACEME
+    pr-url: https://github.com/nodejs/node/pull/65617
+    description: Plain `NO_PROXY` entries now match subdomains, IP entries
+                 are matched exactly, and empty entries are ignored.
 -->
 
 > Stability: 1.1 - Active development
@@ -4620,9 +4625,13 @@ The `NO_PROXY` environment variable supports several formats:
 * `*.example.com` - Wildcard domain match
 * `192.168.1.100` - Exact IP address match
 * `192.168.1.1-192.168.1.100` - IP address range
-* `example.com:8080` - Hostname with specific port
+* `example.com:8080` - Hostname with specific port (exact host match, no
+  subdomains)
 
-Multiple entries should be separated by commas.
+Multiple entries should be separated by commas; empty entries are ignored.
+IP addresses never participate in domain suffix matching: an IP entry only
+bypasses the exact same IP, and no domain entry can bypass a host that is
+an IP address literal.
 
 ### Example
 
diff --git a/lib/internal/http.js b/lib/internal/http.js
index 75e9fe4e8547..b7e7bfdcf063 100644
--- a/lib/internal/http.js
+++ b/lib/internal/http.js
@@ -19,7 +19,7 @@ const {
 
 const { URL } = require('internal/url');
 const { Buffer } = require('buffer');
-const { isIPv4 } = require('internal/net');
+const { isIP, isIPv4 } = require('internal/net');
 const { ERR_PROXY_INVALID_CONFIG } = require('internal/errors').codes;
 let utcCache;
 
@@ -132,7 +132,11 @@ class ProxyConfig {
       this.auth = `Basic ${Buffer.from(auth).toString('base64')}`;
     }
     if (noProxyList) {
-      this.bypassList = noProxyList.split(',').map((entry) => entry.trim().toLowerCase());
+      // Drop empty entries (e.g. from trailing commas) - an empty string
+      // would suffix-match any host ending with a dot.
+      this.bypassList = noProxyList.split(',')
+        .map((entry) => entry.trim().toLowerCase())
+        .filter((entry) => entry !== '');
     } else {
       this.bypassList = []; // No bypass list provided.
     }
@@ -156,6 +160,7 @@ class ProxyConfig {
 
     const host = hostname.toLowerCase();
     const hostWithPort = port ? `${host}:${port}` : host;
+    const hostIsIP = isIP(host) !== 0;
 
     for (let i = 0; i < bypassList.length; i++) {
       const entry = bypassList[i];
@@ -164,14 +169,24 @@ class ProxyConfig {
       if (entry === host || entry === hostWithPort) return false;  // Matching host and host:port
 
       // Strip a leading "." if present, then match as a suffix with a
-      // label boundary. "*.example.com" is handled below (subdomains only).
+      // label boundary. Suffix matching only applies between domains: IP
+      // literals are matched exactly (or by range, below), as documented.
+      // "*.example.com" is handled below (subdomains only).
       if (!entry.startsWith('*.')) {
         const suffix = entry[0] === '.' ? entry.substring(1) : entry;
-        if (host === suffix || (host.endsWith(suffix) && host[host.length - suffix.length - 1] === '.')) return false;
+        if (host === suffix ||
+            (suffix !== '' && !hostIsIP && !isIP(suffix) &&
+             host.endsWith(suffix) && host[host.length - suffix.length - 1] === '.')) {
+          return false;
+        }
       }
 
-      // Handle wildcards like *.example.com
-      if (entry.startsWith('*.') && host.endsWith(entry.substring(1))) return false;
+      // Handle wildcards like *.example.com. IP hosts never match domain
+      // rules, and a bare "*." must not match every host ending with a dot.
+      if (!hostIsIP && entry.length > 2 && entry.startsWith('*.') &&
+          host.endsWith(entry.substring(1))) {
+        return false;
+      }
 
       // Handle IP ranges (simple format like 192.168.1.0-192.168.1.255)
       // TODO(joyeecheung): support IPv6.
diff --git a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
index c43032281705..17c6b25daa25 100644
--- a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
+++ b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
@@ -10,7 +10,7 @@ import { runProxiedRequest } from '../common/proxy-server.js';
 const server = http.createServer(common.mustCall((req, res) => {
   res.writeHead(200, { 'Content-Type': 'text/plain' });
   res.end('Hello World\n');
-}, 7));
+}, 11));
 server.on('error', common.mustNotCall((err) => { console.error('Server error', err); }));
 server.listen(0, '127.0.0.1');
 await once(server, 'listening');
@@ -97,6 +97,83 @@ await once(proxy, 'listening');
   assert.strictEqual(signal, null);
 }
 
+{
+  // Test NO_PROXY with a trailing comma still matching the real entries.
+  const { code, signal, stderr, stdout } = await runProxiedRequest({
+    NODE_USE_ENV_PROXY: 1,
+    REQUEST_URL: `http://test.example.com:${server.address().port}/test`,
+    HTTP_PROXY: `http://localhost:${proxy.address().port}`,
+    RESOLVE_TO_LOCALHOST: 'test.example.com',
+    NO_PROXY: 'example.com,',
+  });
+
+  // The request should succeed and bypass proxy.
+  assert.match(stdout, /Status Code: 200/);
+  assert.match(stdout, /Hello World/);
+  assert.match(stdout, /Resolving lookup for test\.example\.com/);
+  assert.strictEqual(stderr.trim(), '');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+{
+  // Test NO_PROXY with an empty entry (trailing comma) should NOT match
+  // hostnames ending with a dot.
+  const { code, signal, stderr, stdout } = await runProxiedRequest({
+    NODE_USE_ENV_PROXY: 1,
+    REQUEST_URL: `http://evil.com.:${server.address().port}/test`,
+    HTTP_PROXY: `http://localhost:${server.address().port}`,
+    RESOLVE_TO_LOCALHOST: 'evil.com.',
+    NO_PROXY: 'example.com,',
+  });
+
+  // The request should go through the proxy (not bypass it): the empty
+  // entry must not match, and evil.com. does not match example.com.
+  assert.match(stdout, /Status Code: 200/);
+  assert.doesNotMatch(stdout, /Resolving lookup for evil\.com/);
+  assert.strictEqual(stderr.trim(), '');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+{
+  // Test NO_PROXY with a lone "." entry should NOT match hostnames ending
+  // with a dot.
+  const { code, signal, stderr, stdout } = await runProxiedRequest({
+    NODE_USE_ENV_PROXY: 1,
+    REQUEST_URL: `http://evil.com.:${server.address().port}/test`,
+    HTTP_PROXY: `http://localhost:${server.address().port}`,
+    RESOLVE_TO_LOCALHOST: 'evil.com.',
+    NO_PROXY: '.',
+  });
+
+  // The request should go through the proxy (not bypass it).
+  assert.match(stdout, /Status Code: 200/);
+  assert.doesNotMatch(stdout, /Resolving lookup for evil\.com/);
+  assert.strictEqual(stderr.trim(), '');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+{
+  // Test NO_PROXY with a bare "*." entry should NOT match hostnames ending
+  // with a dot.
+  const { code, signal, stderr, stdout } = await runProxiedRequest({
+    NODE_USE_ENV_PROXY: 1,
+    REQUEST_URL: `http://evil.com.:${server.address().port}/test`,
+    HTTP_PROXY: `http://localhost:${server.address().port}`,
+    RESOLVE_TO_LOCALHOST: 'evil.com.',
+    NO_PROXY: '*.',
+  });
+
+  // The request should go through the proxy (not bypass it).
+  assert.match(stdout, /Status Code: 200/);
+  assert.doesNotMatch(stdout, /Resolving lookup for evil\.com/);
+  assert.strictEqual(stderr.trim(), '');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
 {
   // Test NO_PROXY with a plain domain should NOT match partial domain names.
   const { code, signal, stderr, stdout } = await runProxiedRequest({
diff --git a/test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs b/test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs
new file mode 100644
index 000000000000..b8d3aafad525
--- /dev/null
+++ b/test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs
@@ -0,0 +1,65 @@
+// This tests that NO_PROXY IP entries and IP hosts are matched exactly,
+// never as domain suffixes.
+
+import * as common from '../common/index.mjs';
+import assert from 'node:assert';
+import { once } from 'events';
+import http from 'node:http';
+import { runProxiedRequest } from '../common/proxy-server.js';
+
+// Start a server that should NOT be reached directly.
+const server = http.createServer(common.mustNotCall());
+server.listen(0, '127.0.0.1');
+await once(server, 'listening');
+
+// Start a proxy server that should be used for all requests below.
+const proxy = http.createServer(common.mustCall((req, res) => {
+  res.writeHead(200, { 'Content-Type': 'text/plain' });
+  res.end('proxied');
+}, 3));
+proxy.listen(0);
+await once(proxy, 'listening');
+
+// An IP host must not be bypassed by entries that only match it as a
+// string suffix: plain, leading-dot, or wildcard.
+for (const noProxy of ['0.1', '.0.1', '*.0.1']) {
+  const { code, signal, stderr, stdout } = await runProxiedRequest({
+    NODE_USE_ENV_PROXY: 1,
+    REQUEST_URL: `http://127.0.0.1:${server.address().port}/test`,
+    HTTP_PROXY: `http://localhost:${proxy.address().port}`,
+    NO_PROXY: noProxy,
+  });
+
+  // The request should go through the proxy (not bypass it).
+  assert.match(stdout, /Status Code: 200/);
+  assert.match(stdout, /proxied/);
+  assert.strictEqual(stderr.trim(), '');
+  assert.strictEqual(code, 0);
+  assert.strictEqual(signal, null);
+}
+
+{
+  // An IP entry must not bypass a domain host that merely ends with it.
+  // foo.127.0.0.1 is not bypassed by the entry 127.0.0.1, so the request
+  // takes the proxy path, which rejects the numeric-TLD hostname when it
+  // builds the request URL. A bypass regression would instead attempt a
+  // direct connection and call the lookup.
+  const agent = new http.Agent({
+    proxyEnv: {
+      HTTP_PROXY: `http://127.0.0.1:${proxy.address().port}`,
+      NO_PROXY: '127.0.0.1',
+    },
+  });
+  assert.throws(() => {
+    http.request({
+      agent,
+      hostname: 'foo.127.0.0.1',
+      lookup: common.mustNotCall(),
+      path: '/',
+    });
+  }, { code: 'ERR_INVALID_URL' });
+  agent.destroy();
+}
+
+proxy.close();
+server.close();

From 4be166252d7b754edf7f8a302ecac9c925d89b5f Mon Sep 17 00:00:00 2001
From: Nikita Snetkov <lukyanish@gmail.com>
Date: Tue, 1 Sep 2026 11:09:16 +0500
Subject: [PATCH 3/5] fixup! http: match subdomains for plain NO_PROXY entries

Assert that the negative NO_PROXY domain tests actually go through
the proxy: both paths return 200 from the same server, so assert on
the absence of the custom lookup log line instead.

Assisted-by: Claude Fable 5
Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
---
 test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
index 17c6b25daa25..d62b39c18442 100644
--- a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
+++ b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
@@ -187,6 +187,7 @@ await once(proxy, 'listening');
   // The request should go through the proxy (not bypass it),
   // because badexample.com is not a subdomain of example.com.
   assert.match(stdout, /Status Code: 200/);
+  assert.doesNotMatch(stdout, /Resolving lookup for badexample\.com/);
   assert.strictEqual(stderr.trim(), '');
   assert.strictEqual(code, 0);
   assert.strictEqual(signal, null);
@@ -206,6 +207,7 @@ await once(proxy, 'listening');
   // The request should go through the proxy (not bypass it),
   // because notexample.com is not a subdomain of example.com.
   assert.match(stdout, /Status Code: 200/);
+  assert.doesNotMatch(stdout, /Resolving lookup for notexample\.com/);
   assert.strictEqual(stderr.trim(), '');
   assert.strictEqual(code, 0);
   assert.strictEqual(signal, null);
@@ -223,6 +225,7 @@ await once(proxy, 'listening');
   // The request should go through the proxy (not bypass it),
   // because badexample.com is not a subdomain of example.com.
   assert.match(stdout, /Status Code: 200/);
+  assert.doesNotMatch(stdout, /Resolving lookup for badexample\.com/);
   assert.strictEqual(stderr.trim(), '');
   assert.strictEqual(code, 0);
   assert.strictEqual(signal, null);

From 15fa39757965a4dddd5487028397e5c3547ccb5e Mon Sep 17 00:00:00 2001
From: Nikita Snetkov <lukyanish@gmail.com>
Date: Tue, 1 Sep 2026 12:02:07 +0500
Subject: [PATCH 4/5] fixup! http: match subdomains for plain NO_PROXY entries

Reword the NO_PROXY IP-matching note: the previous wording
contradicted the IP range and host:port forms listed above it.

Assisted-by: Claude Fable 5
Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
---
 doc/api/http.md | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index 6e6fd9020bd6..e10db5631cd6 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -4629,9 +4629,8 @@ The `NO_PROXY` environment variable supports several formats:
   subdomains)
 
 Multiple entries should be separated by commas; empty entries are ignored.
-IP addresses never participate in domain suffix matching: an IP entry only
-bypasses the exact same IP, and no domain entry can bypass a host that is
-an IP address literal.
+A plain or leading-dot IP entry matches only that exact IP, and no domain
+entry can bypass a host that is an IP address literal.
 
 ### Example
 

From 09d37d4c0cc4300060bd5b44697aa89eaa1fdacf Mon Sep 17 00:00:00 2001
From: Nikita Snetkov <lukyanish@gmail.com>
Date: Tue, 1 Sep 2026 17:54:10 +0500
Subject: [PATCH 5/5] fixup! http: match subdomains for plain NO_PROXY entries

Keep the change scoped to plain domain entries. Preserve the existing
leading-dot and wildcard behavior, while preventing the new suffix
match from applying to empty entries or IP literals.

Signed-off-by: Nikita Snetkov <lukyanish@gmail.com>
---
 doc/api/http.md                               | 10 +--
 lib/internal/http.js                          | 34 +++-----
 ...est-http-proxy-request-no-proxy-domain.mjs | 79 +++----------------
 ...-http-proxy-request-no-proxy-ip-suffix.mjs | 12 ++-
 4 files changed, 31 insertions(+), 104 deletions(-)

diff --git a/doc/api/http.md b/doc/api/http.md
index e10db5631cd6..ffe06ab62a08 100644
--- a/doc/api/http.md
+++ b/doc/api/http.md
@@ -4562,8 +4562,7 @@ added:
 changes:
   - version: REPLACEME
     pr-url: https://github.com/nodejs/node/pull/65617
-    description: Plain `NO_PROXY` entries now match subdomains, IP entries
-                 are matched exactly, and empty entries are ignored.
+    description: Plain domain entries in `NO_PROXY` now match subdomains.
 -->
 
 > Stability: 1.1 - Active development
@@ -4625,12 +4624,9 @@ The `NO_PROXY` environment variable supports several formats:
 * `*.example.com` - Wildcard domain match
 * `192.168.1.100` - Exact IP address match
 * `192.168.1.1-192.168.1.100` - IP address range
-* `example.com:8080` - Hostname with specific port (exact host match, no
-  subdomains)
+* `example.com:8080` - Hostname with specific port
 
-Multiple entries should be separated by commas; empty entries are ignored.
-A plain or leading-dot IP entry matches only that exact IP, and no domain
-entry can bypass a host that is an IP address literal.
+Multiple entries should be separated by commas.
 
 ### Example
 
diff --git a/lib/internal/http.js b/lib/internal/http.js
index b7e7bfdcf063..dd0f004167fd 100644
--- a/lib/internal/http.js
+++ b/lib/internal/http.js
@@ -132,11 +132,7 @@ class ProxyConfig {
       this.auth = `Basic ${Buffer.from(auth).toString('base64')}`;
     }
     if (noProxyList) {
-      // Drop empty entries (e.g. from trailing commas) - an empty string
-      // would suffix-match any host ending with a dot.
-      this.bypassList = noProxyList.split(',')
-        .map((entry) => entry.trim().toLowerCase())
-        .filter((entry) => entry !== '');
+      this.bypassList = noProxyList.split(',').map((entry) => entry.trim().toLowerCase());
     } else {
       this.bypassList = []; // No bypass list provided.
     }
@@ -168,26 +164,22 @@ class ProxyConfig {
       if (entry === '*') return false;  // * bypasses all hosts.
       if (entry === host || entry === hostWithPort) return false;  // Matching host and host:port
 
-      // Strip a leading "." if present, then match as a suffix with a
-      // label boundary. Suffix matching only applies between domains: IP
-      // literals are matched exactly (or by range, below), as documented.
-      // "*.example.com" is handled below (subdomains only).
-      if (!entry.startsWith('*.')) {
-        const suffix = entry[0] === '.' ? entry.substring(1) : entry;
-        if (host === suffix ||
-            (suffix !== '' && !hostIsIP && !isIP(suffix) &&
-             host.endsWith(suffix) && host[host.length - suffix.length - 1] === '.')) {
-          return false;
-        }
+      // Plain domain entries also match subdomains at a label boundary.
+      // Keep IP hosts and entries out of this new suffix match.
+      if (entry !== '' && entry[0] !== '.' && !entry.startsWith('*.') &&
+          !hostIsIP && isIP(entry) === 0 && host.endsWith(`.${entry}`)) {
+        return false;
       }
 
-      // Handle wildcards like *.example.com. IP hosts never match domain
-      // rules, and a bare "*." must not match every host ending with a dot.
-      if (!hostIsIP && entry.length > 2 && entry.startsWith('*.') &&
-          host.endsWith(entry.substring(1))) {
-        return false;
+      // Follow curl's behavior: strip leading dot before matching suffixes.
+      if (entry[0] === '.') {
+        const suffix = entry.substring(1);
+        if (host === suffix || (host.endsWith(suffix) && host[host.length - suffix.length - 1] === '.')) return false;
       }
 
+      // Handle wildcards like *.example.com
+      if (entry.startsWith('*.') && host.endsWith(entry.substring(1))) return false;
+
       // Handle IP ranges (simple format like 192.168.1.0-192.168.1.255)
       // TODO(joyeecheung): support IPv6.
       if (entry.includes('-') && isIPv4(host)) {
diff --git a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
index d62b39c18442..f5b39d715c6f 100644
--- a/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
+++ b/test/client-proxy/test-http-proxy-request-no-proxy-domain.mjs
@@ -10,7 +10,7 @@ import { runProxiedRequest } from '../common/proxy-server.js';
 const server = http.createServer(common.mustCall((req, res) => {
   res.writeHead(200, { 'Content-Type': 'text/plain' });
   res.end('Hello World\n');
-}, 11));
+}, 8));
 server.on('error', common.mustNotCall((err) => { console.error('Server error', err); }));
 server.listen(0, '127.0.0.1');
 await once(server, 'listening');
@@ -98,72 +98,32 @@ await once(proxy, 'listening');
 }
 
 {
-  // Test NO_PROXY with a trailing comma still matching the real entries.
-  const { code, signal, stderr, stdout } = await runProxiedRequest({
-    NODE_USE_ENV_PROXY: 1,
-    REQUEST_URL: `http://test.example.com:${server.address().port}/test`,
-    HTTP_PROXY: `http://localhost:${proxy.address().port}`,
-    RESOLVE_TO_LOCALHOST: 'test.example.com',
-    NO_PROXY: 'example.com,',
-  });
-
-  // The request should succeed and bypass proxy.
-  assert.match(stdout, /Status Code: 200/);
-  assert.match(stdout, /Hello World/);
-  assert.match(stdout, /Resolving lookup for test\.example\.com/);
-  assert.strictEqual(stderr.trim(), '');
-  assert.strictEqual(code, 0);
-  assert.strictEqual(signal, null);
-}
-
-{
-  // Test NO_PROXY with an empty entry (trailing comma) should NOT match
-  // hostnames ending with a dot.
-  const { code, signal, stderr, stdout } = await runProxiedRequest({
-    NODE_USE_ENV_PROXY: 1,
-    REQUEST_URL: `http://evil.com.:${server.address().port}/test`,
-    HTTP_PROXY: `http://localhost:${server.address().port}`,
-    RESOLVE_TO_LOCALHOST: 'evil.com.',
-    NO_PROXY: 'example.com,',
-  });
-
-  // The request should go through the proxy (not bypass it): the empty
-  // entry must not match, and evil.com. does not match example.com.
-  assert.match(stdout, /Status Code: 200/);
-  assert.doesNotMatch(stdout, /Resolving lookup for evil\.com/);
-  assert.strictEqual(stderr.trim(), '');
-  assert.strictEqual(code, 0);
-  assert.strictEqual(signal, null);
-}
-
-{
-  // Test NO_PROXY with a lone "." entry should NOT match hostnames ending
-  // with a dot.
+  // Test NO_PROXY with a plain domain should NOT match partial domain names.
   const { code, signal, stderr, stdout } = await runProxiedRequest({
     NODE_USE_ENV_PROXY: 1,
-    REQUEST_URL: `http://evil.com.:${server.address().port}/test`,
+    REQUEST_URL: `http://badexample.com:${server.address().port}/test`,
     HTTP_PROXY: `http://localhost:${server.address().port}`,
-    RESOLVE_TO_LOCALHOST: 'evil.com.',
-    NO_PROXY: '.',
+    RESOLVE_TO_LOCALHOST: 'badexample.com',
+    NO_PROXY: 'example.com',
   });
 
-  // The request should go through the proxy (not bypass it).
+  // The request should go through the proxy (not bypass it),
+  // because badexample.com is not a subdomain of example.com.
   assert.match(stdout, /Status Code: 200/);
-  assert.doesNotMatch(stdout, /Resolving lookup for evil\.com/);
+  assert.doesNotMatch(stdout, /Resolving lookup for badexample\.com/);
   assert.strictEqual(stderr.trim(), '');
   assert.strictEqual(code, 0);
   assert.strictEqual(signal, null);
 }
 
 {
-  // Test NO_PROXY with a bare "*." entry should NOT match hostnames ending
-  // with a dot.
+  // Test that an empty plain entry does not match a hostname ending in a dot.
   const { code, signal, stderr, stdout } = await runProxiedRequest({
     NODE_USE_ENV_PROXY: 1,
     REQUEST_URL: `http://evil.com.:${server.address().port}/test`,
     HTTP_PROXY: `http://localhost:${server.address().port}`,
     RESOLVE_TO_LOCALHOST: 'evil.com.',
-    NO_PROXY: '*.',
+    NO_PROXY: 'example.com,',
   });
 
   // The request should go through the proxy (not bypass it).
@@ -174,25 +134,6 @@ await once(proxy, 'listening');
   assert.strictEqual(signal, null);
 }
 
-{
-  // Test NO_PROXY with a plain domain should NOT match partial domain names.
-  const { code, signal, stderr, stdout } = await runProxiedRequest({
-    NODE_USE_ENV_PROXY: 1,
-    REQUEST_URL: `http://badexample.com:${server.address().port}/test`,
-    HTTP_PROXY: `http://localhost:${server.address().port}`,
-    RESOLVE_TO_LOCALHOST: 'badexample.com',
-    NO_PROXY: 'example.com',
-  });
-
-  // The request should go through the proxy (not bypass it),
-  // because badexample.com is not a subdomain of example.com.
-  assert.match(stdout, /Status Code: 200/);
-  assert.doesNotMatch(stdout, /Resolving lookup for badexample\.com/);
-  assert.strictEqual(stderr.trim(), '');
-  assert.strictEqual(code, 0);
-  assert.strictEqual(signal, null);
-}
-
 // Test NO_PROXY with leading-dot entry should NOT match partial domain names.
 // Regression test: .example.com must not match notexample.com or badexample.com.
 {
diff --git a/test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs b/test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs
index b8d3aafad525..0b42885664bd 100644
--- a/test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs
+++ b/test/client-proxy/test-http-proxy-request-no-proxy-ip-suffix.mjs
@@ -1,5 +1,4 @@
-// This tests that NO_PROXY IP entries and IP hosts are matched exactly,
-// never as domain suffixes.
+// This tests that plain NO_PROXY entries do not suffix-match IP addresses.
 
 import * as common from '../common/index.mjs';
 import assert from 'node:assert';
@@ -16,18 +15,17 @@ await once(server, 'listening');
 const proxy = http.createServer(common.mustCall((req, res) => {
   res.writeHead(200, { 'Content-Type': 'text/plain' });
   res.end('proxied');
-}, 3));
+}));
 proxy.listen(0);
 await once(proxy, 'listening');
 
-// An IP host must not be bypassed by entries that only match it as a
-// string suffix: plain, leading-dot, or wildcard.
-for (const noProxy of ['0.1', '.0.1', '*.0.1']) {
+{
+  // A plain entry must not bypass an IP host by matching a string suffix.
   const { code, signal, stderr, stdout } = await runProxiedRequest({
     NODE_USE_ENV_PROXY: 1,
     REQUEST_URL: `http://127.0.0.1:${server.address().port}/test`,
     HTTP_PROXY: `http://localhost:${proxy.address().port}`,
-    NO_PROXY: noProxy,
+    NO_PROXY: '0.1',
   });
 
   // The request should go through the proxy (not bypass it).