{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f045a006-75a8-5cf1-9311-d8effbb8adc9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.18.1-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/axios@0.18.1-tuxcare.6", "version": "0.18.1-tuxcare.6", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@0.18.1", "type": "library", "version": "0.18.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:952b08b7-ed83-5d56-a932-54c885506e77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:1bd79572-687a-5c77-9649-fb0846c2cc59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-28168 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:1d274e5e-9cea-5d2d-9838-f7708feeb27e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-3749 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:3e372518-4fd7-5167-be7b-794e801f27d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:30c5940e-dc11-50f7-bb07-ddb394974d26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39338 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:fce97276-1257-54fa-9a79-ad99f198da65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:aa2cf0f3-0d47-5928-ab9a-716157f63b96", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:b663ccd2-11d2-5343-bb6a-8fbb1333837f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58754 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:cf2ef713-11d6-52bc-95c6-1c9c931d83e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-62718 does not affect version 0.18.1-tuxcare.6 of axios. axios 0.18.1 has no no_proxy support at all (added upstream in 38de2525, first released in 0.19.0), so the no_proxy hostname-normalization matching loop this CVE bypasses does not exist; the proxy is resolved solely via getProxyForUrl() with no hostname matching.", "justification": "code_not_present" } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c2e95e27-5e2c-593b-a4de-de581c2ed556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:77b4728e-365d-56b4-8638-53ccbd1f30b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0f90e0da-76b1-5528-a7d7-403a726fe12c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:632a3095-1fa4-5814-88ab-c8f70c74bff6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:b18ef838-a82c-55e3-87f7-a6f3689a215e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:1d33f80c-0d77-5989-a339-1d97cb42f235", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:548c5cd2-6f8a-5de8-bb66-1ccc11351afe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:6a2749e9-b403-586c-a95c-3995ad77fa49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:ccc41712-6075-5708-9bf4-374dd9e22c26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:cc8f75c2-300d-566c-bead-c220d0bb8c80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0241f5e1-24ed-5b98-a967-390d54f38096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:4e807c8a-18f1-5b20-8a96-57dbce951081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:62fc19e7-7a2b-5781-aa0a-e4cbc8a5b8ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:69d2b3a8-5f54-56df-9483-9b94e0a5afdf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 The target repository (axios 0.18.1-tuxcare.4) is not affected by CVE-2026-39865. This CVE describes an HTTP/2 session cleanup state corruption bug in the Http2Sessions class that was fixed in axios 1.13.2. The target version (0.18.1) predates the introduction of HTTP/2 support in axios, which was added in the 1.x series. The target's lib/adapters/http.js (302 lines) only supports HTTP/1.1 usin...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0495c073-1b2d-5bd5-ae1c-73d88f27d61d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c55e25a6-7bb8-576d-82f1-7e8c42434e3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0539e410-38ed-5450-9c20-9380687bf23d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42034 does not affect version 0.18.1-tuxcare.6 of axios. axios 0.18.1 never reads config.maxBodyLength; lib/defaults.js defines only maxContentLength (a response-size limit), so there is no configurable request-body limit to bypass. Confirmed with a PoC against 0.18.1.", "justification": "code_not_present" } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:92568bd8-909d-588f-85c4-0875e782877d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42035 does not affect version 0.18.1-tuxcare.6 of axios. Version 0.18.1 (SHA 3256bcea) is NOT affected by CVE-2026-42035. The vulnerable code path does not exist in this version. The attack requires two components: (1) a duck-typed isFormData() function that can be fooled by prototype pollution, and (2) code in lib/adapters/http.js that calls data.getHeaders() and merges the result into request headers. Version 0.18.1 has NEITHER: isFormData() uses instanceof (cannot be spoofed), and http.js has no getHeaders() call. The vulnerable code was introduced AFTER this version in a major ES6 rewrite (302\u2192751 lines), then fixed by commit 854c54e0 authored by CloudLinux engineer Krystyna Tomaszewa. Type A2: INPUT (plain object with polluted properties) is received but no code path reaches GOAL (header injection) because transformRequest JSON-stringifies plain objects before they reach the http adapter.", "justification": "code_not_present" } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:0c251ed0-e0d7-5b4a-aab3-fa4d6753fe43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:ecf2da1d-5fe6-5fe5-a934-9b5c669e7e12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 Axios 0.18.1 is not affected by CVE-2026-42037. The vulnerable code path (lib/helpers/formDataToStream.js) does not exist in this version. The formDataToStream helper that builds multipart form-data bodies and interpolates unsanitized value.type into Content-Type headers was introduced in axios v1.3.0 (January 2023), approximately 5 years after v0.18.1 (2018). Version 0.18.1 delegates all FormD...", "justification": "code_not_present" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:212b1ff2-ab83-5257-81e3-a860e46c8898", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42038 does not affect version 0.18.1-tuxcare.6 of axios. The loopback-equivalence bug lives entirely inside the no_proxy matching loop of lib/adapters/http.js, and axios 0.18.1 has no no_proxy support (added upstream in 38de2525, first released in 0.19.0); neither the matching loop nor isLoopbackHost.js exists.", "justification": "code_not_present" } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:b020c1f3-a60f-56c5-a8b6-b8105e3202db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:6c4523ac-df75-50b0-b6e0-c7df9db4b522", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 Version 0.18.1 is not affected by CVE-2026-42040. The vulnerable component `lib/helpers/AxiosURLSearchParams.js` does not exist in this version\u2014it was introduced in v1.0.0-alpha.1 (commit 934f390c), which postdates 0.18.1. The buildURL.js encode function that exists in 0.18.1 does not contain the reverse-encoding charMap entry ('\"%00\": \"\\x00\"') that causes the vulnerability. Testing confirms th...", "justification": "code_not_present" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:3135fcd8-a9d5-5db2-bf7a-8a9fced562be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42041 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 Axios v0.18.0 is NOT AFFECTED by CVE-2026-42041. The vulnerable code pattern (lib/core/mergeConfig.js with mergeDirectKeys function using the 'in' operator) was introduced in v0.22.0 (September 2021), more than 3 years after v0.18.0 was released (February 2018). Version 0.18.0 uses a completely different architecture: utils.merge() with forEach() that employs Object.prototype.hasOwnProperty che...", "justification": "code_not_present" } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:b7ea5873-cf2a-5619-89da-6f94f8753e17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 The target version (axios 0.18.1) is NOT AFFECTED by CVE-2026-42042. The vulnerability concerns the `withXSRFToken` configuration property introduced in later axios versions. Version 0.18.1 predates this feature and uses a completely different XSRF token mechanism based on the `withCredentials` property. Exhaustive searches confirm `withXSRFToken` does not exist anywhere in the codebase, and th...", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:5649ea7f-d95c-5581-9980-fdf26771b6cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42043 does not affect version 0.18.1-tuxcare.6 of axios. Target version 0.18.1 is not affected by CVE-2026-42043. The vulnerability describes an incomplete fix in lib/helpers/shouldBypassProxy.js (lines 1-3) where a hardcoded loopback address set recognizes only 127.0.0.1 instead of the full 127.0.0.0/8 subnet. Version 0.18.1 does not contain this file or any NO_PROXY handling logic. NO_PROXY support was first introduced in axios v0.19.0 (August 2018), and version 0.18.1 predates this feature entirely. The vulnerable code pattern is not present.", "justification": "code_not_present" } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:f0830291-8d75-5d2c-9e10-93b75c275c49", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 Target version axios 0.18.1-tuxcare.7 is not affected by CVE-2026-42044 because the parseReviver feature was not introduced until v1.11.0+ (August 2025), approximately 7 years after this version. The target uses plain JSON.parse(data) without any reviver parameter at lib/defaults.js:60, making prototype pollution of Object.prototype.parseReviver irrelevant. The vulnerable code pattern (this.par...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:5d84a483-c598-53e4-96db-681c0f7dfc3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:c6f14e31-8060-5ee0-b5e1-8ce1488148d1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44486 does not affect version 0.18.1-tuxcare.6 of axios. already_fixed \u2014 The target repository already contains the fix for CVE-2026-44486 (Proxy-Authorization header leak on redirect). The fix was backported in commit 806a27b (also 3a086d9 in a backport branch), which implements the exact same defense as vendor commit afca61a070728e717203c2bc21e7b589b59b858b.", "justification": "code_not_present" } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:6de222fd-2ca1-5e69-9daf-0042b93ca945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44487 does not affect version 0.18.1-tuxcare.6 of axios. already_fixed \u2014 The target repository already contains the fix for CVE-2026-44487 (GHSA-j5f8-grm9-p9fc). The exact vendor commit afca61a070728e717203c2bc21e7b589b59b858b was backported in commit 806a27b as part of CVE-2024-28849 remediation on April 28, 2026. The defense mechanism strips stale Proxy-Authorization headers on redirect re-invocations, preventing credential leakage to unintended recipients.", "justification": "code_not_present" } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:1ffe24dc-4f65-5ba3-ab25-99a43691209e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:6bf6b818-a6c6-54a5-b217-6a00b930b699", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44489 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:15eb29e8-4d36-5744-8b3f-cafd6962c9ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:39987cd9-2119-5d63-abe8-1788e0eb440b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44492 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 The target repository axios v0.18.1-tuxcare.2 does not implement NO_PROXY functionality at all. The vulnerability CVE-2026-44492 is specific to shouldBypassProxy.js (introduced in v1.15.0) which handles NO_PROXY hostname comparison. Since v0.18.1 predates this feature and has no hostname comparison or bypass logic, the vulnerability pattern cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:9500f53e-69ea-57c9-87c5-4392e1e1a94d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:d2619173-62b0-5e38-b2aa-8f0736ad3dde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:48da4342-b173-504a-8fc5-18cfccddc8c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:a0980e21-7cd3-5224-aaff-4259515eb0eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 The target axios version 0.18.1-tuxcare.7 is not affected by CVE-2026-67312. The CVE explicitly states it affects versions \"from 0.28.0 before 0.33.0 and from 1.0.0 before 1.18.0\". Version 0.18.1 predates the introduction of the vulnerable formDataToJSON feature. The vulnerable code (formDataToJSON.js with buildPath recursion parsing bracket-delimited field names) does not exist in this version...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:f1a5cf25-c9ac-5e3d-9a63-8270f094ed52", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 axios 0.18.1-tuxcare.7 has no formDataToJSON/formToJSON helper and no recursive FormData-to-JSON conversion. The CVE itself says versions before 0.28.0 lack this helper. The default transformRequest returns FormData untouched. The secondary shouldBypassProxy issue is also absent, because this version has no NO_PROXY handling or shouldBypassProxy.", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:ffc6c68b-1eca-52d0-9ec1-de57ab281a7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:32faa546-b58f-5668-a773-24e7dddcaf4f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67315 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 The target is axios 0.18.1-tuxcare.7. The vulnerable component, lib/helpers/shouldBypassProxy.js with its isLoopback() NO_PROXY comparison, was added in axios 1.15.0 and does not exist here. The 0.18.1 HTTP adapter has no NO_PROXY handling at all, so there is no \"0.0.0.0 treated differently from 127.0.0.1\" flaw to fix.", "justification": "code_not_present" } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:40a7aaf8-3c43-535d-a68c-7694afd65a84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67316 affects version 0.18.1-tuxcare.6 of axios, and is fixed in 0.18.1-tuxcare.7." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:7ac49f85-efd8-594f-8967-9d8d665086be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 Not affected. The target is axios 0.18.1-tuxcare.7, which predates the fetch adapter. The CVE is in lib/adapters/fetch.js (getBodyLength, the maxBodyLength check and trackStream), and that file and every fetch-based code path are absent from this repo. The repo has only the http and xhr adapters, and no axios-level maxBodyLength option.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:185fe1d5-ea05-51d3-95d3-5f375391f1c4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 axios 0.18.1 (tuxcare.7) has no HTTP/2 support. CVE-2026-67318 needs the Node HTTP/2 transport (httpVersion: 2) to skip the stream byte-counting wrapper, and that transport does not exist here. The only transports are http, https and follow-redirects. The `maxBodyLength` config option and the stream wrapper also don't exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:d2c05076-1aca-5908-b6d8-0b638ca6baa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:3516554f-b682-5894-9b3a-780e35d1ec9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:ec9fcf57-2d6c-54b6-9bcf-b78f638feb7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 0.18.1-tuxcare.6 of axios. not_affected \u2014 Target is axios 0.18.1-tuxcare.7. The vulnerable code from CVE-2026-67321 (the toFormData helper with its top-level '{}' metatoken shortcut that calls JSON.stringify before a maxDepth guard) does not exist in this version. The 0.18.x line has no toFormData, no toURLEncodedForm, no AxiosURLSearchParams, no formSerializer, no maxDepth guard and no '{}' key handling. The affected code (introduced ...", "justification": "code_not_present" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:de65c981-31b1-54f1-aa8c-77c8f5433eb3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:756579ad-b6c8-5c67-ab91-d1653f09dded", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:771c3026-5f2c-5bf3-8d79-42e0fc5580d1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:aa97bc9f-7abe-517c-9779-89110588c49b", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:2cb36192-3aac-5fb1-8ada-d04df49b2e1c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:fef33d68-31ea-5bef-b94a-d82c5408e48e", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:f796b45d-ffb5-5e17-8826-a9ce1df357a2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.18.1-tuxcare.6 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:577a7357-cbf9-5d6b-8ed5-add74a9a21fe", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:222a11fa-adf9-52f1-927e-f9f75583bf46", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:fbe99ae2-379b-5644-835c-146398790153", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:3314ae9d-16f5-5383-9ad4-7f03be9c4338", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.18.1-tuxcare.6." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ], "bom-ref": "urn:uuid:75e7275a-2223-5c72-875a-8b8da0b00646", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.18.1-tuxcare.6 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.6" } ] }