diff --git a/packages/fetch/src/util.test.ts b/packages/fetch/src/util.test.ts
index 9259dba1494..ccec1f3fae4 100644
--- a/packages/fetch/src/util.test.ts
+++ b/packages/fetch/src/util.test.ts
@@ -76,6 +76,7 @@ test("patternMatchesHostname with wildcard domains", () => {
 test("patternMatchesHostname with domain suffix", () => {
   expect(patternMatchesHostname("sub.example.com", ".example.com")).toBe(true);
   expect(patternMatchesHostname("example.com", ".example.com")).toBe(true);
+  expect(patternMatchesHostname("badexample.com", ".example.com")).toBe(false);
   expect(patternMatchesHostname("different.com", ".example.com")).toBe(false);
 });
 
@@ -121,6 +122,9 @@ test("patternMatchesHostname with domain suffix and ports", () => {
   expect(patternMatchesHostname("example.com:8080", ".example.com:8080")).toBe(
     true,
   );
+  expect(
+    patternMatchesHostname("badexample.com:8080", ".example.com:8080"),
+  ).toBe(false);
   expect(
     patternMatchesHostname("sub.example.com:9090", ".example.com:8080"),
   ).toBe(false);
@@ -157,6 +161,7 @@ test("shouldBypassProxy works with domain suffix", () => {
   process.env.NO_PROXY = ".example.com";
   expect(shouldBypassProxy("sub.example.com", undefined)).toBe(true);
   expect(shouldBypassProxy("example.com", undefined)).toBe(true);
+  expect(shouldBypassProxy("badexample.com", undefined)).toBe(false);
   expect(shouldBypassProxy("different.com", undefined)).toBe(false);
 });
 
@@ -166,6 +171,7 @@ test("shouldBypassProxy handles multiple entries with different patterns", () =>
   expect(shouldBypassProxy("sub.example.com", undefined)).toBe(true);
   expect(shouldBypassProxy("sub.test.com", undefined)).toBe(true);
   expect(shouldBypassProxy("test.com", undefined)).toBe(true);
+  expect(shouldBypassProxy("contest.com", undefined)).toBe(false);
   expect(shouldBypassProxy("example.org", undefined)).toBe(false);
 });
 
@@ -182,6 +188,7 @@ test("shouldBypassProxy with ports in NO_PROXY", () => {
   expect(shouldBypassProxy("sub.test.org:443", undefined)).toBe(true);
   expect(shouldBypassProxy("sub.internal.net:8443", undefined)).toBe(true);
   expect(shouldBypassProxy("internal.net:8443", undefined)).toBe(true);
+  expect(shouldBypassProxy("notinternal.net:8443", undefined)).toBe(false);
 });
 
 test("shouldBypassProxy accepts options with noProxy patterns", () => {
diff --git a/packages/fetch/src/util.ts b/packages/fetch/src/util.ts
index ed18cb6a32a..fc5812b5900 100644
--- a/packages/fetch/src/util.ts
+++ b/packages/fetch/src/util.ts
@@ -74,11 +74,14 @@ export function patternMatchesHostname(hostname: string, pattern: string) {
     return true;
   }
   // Domain suffix match (.example.com)
-  if (
-    patternWithoutPort.startsWith(".") &&
-    hostnameWithoutPort.endsWith(patternWithoutPort.slice(1))
-  ) {
-    return true;
+  if (patternWithoutPort.startsWith(".")) {
+    const suffixWithoutDot = patternWithoutPort.slice(1);
+    if (
+      hostnameWithoutPort === suffixWithoutDot ||
+      hostnameWithoutPort.endsWith(patternWithoutPort)
+    ) {
+      return true;
+    }
   }
 
   // TODO IP address ranges