{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7d3403df-9d74-561e-ac79-ae35eaa6dcf3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.18.0", "type": "library", "bom-ref": "pkg:npm/axios@0.18.0", "version": "0.18.0", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:2123745c-e2ac-5c7a-a55b-402c0c52dbc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.2." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:892b9136-84bc-53ab-8140-c195c65e4141", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-28168 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.2." } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:73fa70ae-16b5-5184-a89f-50c567ae3ed2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.4." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:46e3ca7d-bdcc-59d9-af18-f7e21a5f9728", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45857 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.4." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:df7c4bc9-df3b-5db7-8424-41acd7ed4567", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39338 affects version 0.18.0 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:28acbc3d-bd92-5532-8ecc-d357e6165b84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27152 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.4." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:37fd8883-f4af-56bd-9ed1-b8e80c9452a2", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.18.0." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:fcc22679-0774-5010-8d05-15c12d6971be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 0.18.0 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:15f6c789-df50-5d64-b14d-d49e4f512b02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-62718 does not affect version 0.18.0 of axios. not_affected \u2014 Axios version 0.18.0 is not affected by CVE-2025-62718 because the NO_PROXY functionality was not introduced until version 0.19.0 (August 2018), approximately 6 months after v0.18.0 was released (February 2018). The vulnerability specifically concerns improper hostname normalization in NO_PROXY matching logic, but since v0.18.0 has no NO_PROXY support whatsoever, the vulnerable code pattern can...", "justification": "code_not_present" } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:248a9076-03cd-57b3-bf28-4679d97e2cfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:9cfbeecd-0a00-58d4-b80a-021fa5381470", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:049464d0-3058-5cfb-9d63-4fb40a2ab1ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:6b0d0b7b-9e71-56a6-ba86-41b0ae45d61d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:661cb84f-b604-585e-8e90-ba1cf0ba3bc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:d141d9d6-efdf-5495-b1e3-4870ecee375f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:f68c3eb7-f374-502d-b473-7fb7b5320643", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:6da7fa6e-4f80-54b8-8164-3a285b31bf70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:5e011b10-f92e-5c13-a530-032002b8faf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:e7bf5163-dde1-5269-bebd-54f0ade13ab4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:ccc22665-d0bb-5a9d-82bf-6272209f0d27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:3ef0fe2e-b585-5b2b-8ece-6bb6a1c8976a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:5194f540-267c-537e-a059-358c635d1621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25639 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.1." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:ec0e6e88-c267-5d00-88fd-36f1af3fa051", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.18.0 of axios. not_affected \u2014 Axios 0.18.0-tuxcare.3 is not affected by CVE-2026-39865. The vulnerability exists in HTTP/2 session cleanup logic (Http2Sessions class) that was introduced in a later version. This version only supports HTTP/1.1 and does not contain any HTTP/2 implementation, the vulnerable splice-in-loop pattern, or any session management code. HTTP/2 support was added in commit d676df77 which is not an ances...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:80c19afd-2490-5a66-b2bc-e36f3f67a0de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40175 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.4." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:13c0e77e-0796-5b79-98a6-9a352a72b153", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42033 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.3." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:ec842db1-0635-5cbc-a64e-3461b3e3f5d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42034 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.3." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:a7a2416f-abb5-5f38-a1b7-c08a817cc00b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42035 does not affect version 0.18.0 of axios. 0.18.0 never calls FormData getHeaders(); the gadget first appears in axios 0.27.0 (absent in 0.26.1). Verified against the npm tarball (manual review 2026-10-26).", "justification": "code_not_present" } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:e3eff5c0-c45f-56b3-a9c4-9a8afb50c02a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42036 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.2." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:840b0bb1-2a34-59cf-8637-b0e6ef871e0b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.18.0 of axios. not_affected \u2014 Axios 0.18.0 is NOT AFFECTED by CVE-2026-42037. The vulnerability requires the `formDataToStream.js` helper which did not exist in this version. Axios 0.18.0 has no custom multipart FormData serialization implementation: in browsers it delegates to native XMLHttpRequest (secure), and in Node.js the http adapter explicitly rejects FormData. The vulnerable code path (unsafe interpolation of `valu...", "justification": "code_not_present" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:b2f80a3f-087a-52d9-9c12-e8f6c6652e89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42038 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.3." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:5ff6c798-9006-5f94-b214-9c233a6d03f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42039 does not affect version 0.18.0 of axios. not_affected \u2014 Axios 0.18.0 is not affected by CVE-2026-42039. The vulnerable code (lib/helpers/toFormData.js with its unbounded recursive walker) does not exist in this version - it was introduced later in v0.25.0. Version 0.18.0 uses JSON.stringify() for object serialization, which does not crash at the CVE's attack depth (2,500 levels). Empirical testing confirms JSON.stringify succeeds at depth 2,500 and ...", "justification": "code_not_present" } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:740d87a8-bce8-5e68-b260-e6355f40ab37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 0.18.0 of axios. not_affected \u2014 Version 0.18.0 is not affected by CVE-2026-42040. The vulnerable component (lib/helpers/AxiosURLSearchParams.js with the null-byte reverse-encoding bug) does not exist in this version. Version 0.18.0 uses a different URL encoding mechanism (buildURL.js) that safely preserves percent-encoded null bytes (%00) without reversing them to raw null bytes (\\x00). The AxiosURLSearchParams feature was in...", "justification": "code_not_present" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:1b9c37a5-83e8-544d-8044-a3628e860def", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42041 does not affect version 0.18.0 of axios. not_affected \u2014 Version 0.18.0 is NOT affected by CVE-2026-42041. The vulnerability exists in the `mergeDirectKeys` function within `lib/core/mergeConfig.js`, which uses the `in` operator for property checking. This architectural component was introduced in commit 0d69a79c (June 2020) and first appeared in v0.20.0. Version 0.18.0 (February 2018) pre-dates this change and uses a different config merging strateg...", "justification": "code_not_present" } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:a6940d9b-ece9-569c-b69c-684994524da3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 0.18.0 of axios. not_affected \u2014 CVE-2026-42042 describes a prototype pollution gadget in the `withXSRFToken` config option that causes XSRF tokens to leak cross-origin when truthy non-boolean values short-circuit the same-origin check. The target (axios v0.18.0 from February 2018) does not have the `withXSRFToken` config option at all - this feature was introduced in November 2023, 5+ years after v0.18.0 was released. The vul...", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:b1a8a983-c1ac-57e2-b47a-9f49562e5baa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42043 does not affect version 0.18.0 of axios. 0.18.0 has no NO_PROXY/shouldBypassProxy support at all, so the incomplete-loopback bypass cannot occur. Verified against the npm tarball (manual review 2026-10-26).", "justification": "code_not_present" } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:b01e5ae1-563a-5b2e-8020-2734ccc56e41", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.18.0 of axios. not_affected \u2014 Axios 0.18.0-tuxcare.3 is NOT AFFECTED by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerability requires JSON.parse to be called with a reviver parameter that can inherit from Object.prototype.parseReviver. The target version uses a fundamentally different architecture: lib/defaults.js:60 calls JSON.parse(data) with ZERO parameters, never accessing any reviver. The vulnera...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:0d88b06c-ae8c-51ae-a37f-7b76622bc078", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:8a3d6f8a-0e98-509f-8adb-0b59375e90af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44486 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.2." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:a736076a-b919-5c00-9197-0f102b069b77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44487 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.2." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:77c145c5-b2a7-5ace-95d2-1d02b5ef8589", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:aad837f0-8da8-54d8-be52-3a0c9001fbb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44489 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:b73716fa-9a24-5bda-a465-25e0b8f22bfd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44490 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.1." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:6454305e-975e-5c6b-869d-c9883ac71012", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44492 does not affect version 0.18.0 of axios. 0.18.0 has no NO_PROXY/shouldBypassProxy code; the IPv4-mapped IPv6 normalization bypass cannot occur. Verified against the npm tarball (manual review 2026-10-26).", "justification": "code_not_present" } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:18273db5-09f1-5f74-b234-9d8bc2f0e274", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:ec2cbf3c-6f36-5dd1-8378-95066b29c5a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:b26cb14d-3324-53e1-a669-2f6346d708ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44496 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.4." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:653276c1-4204-54ae-8fa0-1db50fb4f434", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.18.0 of axios. not_affected \u2014 axios 0.18.0 is not affected by CVE-2026-67312. The vulnerable formDataToJSON helper (and its recursive bracket-parsing functions parsePropPath and buildPath) does not exist in this version. This functionality was introduced 10 versions later in v0.28.0 (commit c008e57f). In 0.18.0, FormData is passed through unchanged to the browser/Node.js without any custom parsing, so the unbounded recursio...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:f911657f-0106-5bff-bff0-4a01f8a5be4e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 0.18.0 of axios. not_affected \u2014 axios 0.18.0-tuxcare.4 has no FormData-to-JSON conversion. lib/helpers/formDataToJSON.js, formToJSON() and the bracket-path parser do not exist, and the default transformRequest returns FormData unchanged. The CVE says the feature first appeared in 0.28.0. The unbounded recursion on nested bracket field names therefore cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:5d7c8f01-00ed-5819-9b4e-6ed7f5137ebf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:b657ff37-e317-5ca6-9779-42762a3658d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67315 does not affect version 0.18.0 of axios. not_affected \u2014 axios 0.18.0-tuxcare.4 has no NO_PROXY handling at all. lib/helpers/shouldBypassProxy.js and isLoopback() do not exist. The CVE's flaw is that 0.0.0.0 is missing from the loopback-equivalence check used to match NO_PROXY entries. Here the http adapter applies http_proxy/https_proxy to every host and never consults NO_PROXY, so there is no exclusion policy for 0.0.0.0 to slip past. 127.0.0.1 is ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:4f7ad915-0baf-5c4e-86ff-6519f67f97e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67316 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.2." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:81358e3d-8553-5da3-8331-f589171f875f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.18.0 of axios. not_affected \u2014 axios 0.18.0-tuxcare.4 has no fetch adapter. Only lib/adapters/http.js and lib/adapters/xhr.js exist. The vulnerable code (fetch adapter getBodyLength/trackStream with maxBodyLength) does not exist in this version, so the CVE does not apply.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:e4b9c79c-e1ef-5f26-8e1e-4a482dea4e8f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.18.0 of axios. not_affected \u2014 Target is axios 0.18.0-tuxcare.4. It has no HTTP/2 transport or httpVersion option and no maxBodyLength request-body config. The vulnerable chain (stream body, HTTP/2 transport, finite cap, wrapper not applied) cannot occur. Only HTTP/1.1 transports (http, https, follow-redirects) exist.", "justification": "code_not_present" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:1a10b2aa-5fc0-5abc-a673-257486d0112b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67319 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.4." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:58740aa2-12a9-5743-a4bf-6a66b044aed7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.18.0 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:42dae689-2cb5-5114-a010-2552d4ae098b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 0.18.0 of axios. not_affected \u2014 axios 0.18.0-tuxcare.4 predates the vulnerable component. CVE-2026-67321 is a bypass of the maxDepth guard in lib/helpers/toFormData.js, where a top-level key ending in '{}' is passed to JSON.stringify before the guard runs. This tree has no toFormData.js, no '{}' metatoken shortcut, no maxDepth guard and no form or urlencoded object serialization, so the flaw as described does not exist. The C...", "justification": "code_not_present" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:23f2cac0-d0b5-53a9-a8b9-291cec8e0d3b", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.18.0." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:bb201dc8-37b3-5298-8076-1f296dd212b9", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.18.0." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:a86b00be-6c25-536c-9a80-45005ef04857", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.18.0." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:367674af-8cff-5f90-861b-ede26a1febf3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.18.0." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:d32cac98-0400-5ab5-bb42-96498f26f1a0", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.18.0." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:f8846d31-88c2-5648-a7b2-1525f42a59b9", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.18.0." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:257d85e3-ef30-5a54-97e8-35d2bcaf4c4b", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.18.0." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:6221614b-cf5e-567b-a535-9ea22b6574e9", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.18.0." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:b0ee15f3-6d81-508e-b1f1-39ad7d8e43b3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.18.0." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.18.0" } ], "bom-ref": "urn:uuid:da644cf3-b7b5-5d21-bf17-669514417458", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.18.0." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.18.0" } ] }