{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e239aa62-25cc-58df-b0e4-6d62ce0041e0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.19.2-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/axios@0.19.2-tuxcare.6", "version": "0.19.2-tuxcare.6", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@0.19.2", "type": "library", "version": "0.19.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:56041ee5-29ee-5468-940a-0abdc93f5da5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:4be5ee2e-15bc-5e3d-af5d-2d87437f669f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-28168 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:91059c55-b203-5081-a8ff-b2bbe90ab772", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-3749 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:27be1b4b-49bb-5138-9eee-97d10545de50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:4cf652ec-b338-5e46-9b9d-f91813356adb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39338 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:317775d2-270d-5b32-bcf2-dec55ff74fb6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:b7e96f61-b2af-5c42-ad8e-e32666a5f141", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:278df4f8-4972-563a-868a-897a5e84f264", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:88c5be3a-6b55-5255-b0ab-c82ed6294821", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1a13df72-4983-541a-97d4-8af31c67c945", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5530d58f-1215-575b-b56c-45465c6fbbaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:a0ca43a1-5bfa-52e0-9bff-a8fac1e8a101", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:cdc21b03-94d6-5b8b-bbb7-2bbdfc57ca3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:d0b24e8a-51f9-5107-af86-61e919a97342", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:98904a0a-f0f3-5331-a02a-04bf7cd102ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:4e3e5359-41df-5d08-8e46-7a3f87fc2481", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5a6cbf77-cf7d-5db1-9980-d852d60ab7bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:6804fe7f-34bc-58d1-9e76-991c414fd076", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:50e8cfa4-8620-5df8-8ee3-a571135a1fd7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:b72cae6e-84cb-5bda-81ae-6bffb47f44a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:927cd07e-ae44-5509-a324-6d1a17890b66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:241449bb-3bfe-56cd-9efe-a271e864b292", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:8988e2a7-cd57-536a-878b-d5e4afd9e1c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 Target axios 0.19.2-tuxcare.7 is NOT affected by CVE-2026-39865. The vulnerability exists in the Http2Sessions class session cleanup logic introduced with HTTP/2 support in axios 1.13.2 (October 2025). The target version (0.19.2) predates HTTP/2 support and contains no HTTP/2 code whatsoever. The vulnerable code pattern (continuing loop iteration after array.splice() in session cleanup) does no...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:62797527-4bfd-593f-ac61-51114914a14a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f46dbafb-ad65-579d-a519-f3f1d7eec58d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7ca6e574-b8dc-5bef-9c64-739d4590fbd8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:d648e9ff-674b-5146-a084-b565eb5e8d7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5b900ac2-e80e-592f-9649-4b248e527208", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ae686bc2-7261-59cc-b3ba-a9a2515696c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 Version 0.19.2 is not affected by CVE-2026-42037. The vulnerable file lib/helpers/formDataToStream.js does not exist in this version. This module was introduced in axios v1.0.0+ (October 2022) to enable Node.js FormData support. Version 0.19.2 (January 2020) lacks FormData-to-multipart-stream conversion entirely; the http adapter rejects FormData objects with error \"Data after transformation mu...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:33ee7305-1234-5a74-b07a-9a734fc342b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:37042214-801a-5a19-90fc-9b9fedae9b71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:4c5a312f-1f37-5e20-baf3-65c625bcf129", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ef45d402-4ab7-5dff-b969-44d7faee59dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:da58ae58-133a-5740-800a-427cc6110700", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:8f1b6c30-e4e3-5019-9036-4d85f0ab66e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42043 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:90803860-c2fc-5393-ab84-836aef1b9479", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 CVE-2026-42044 describes a prototype pollution gadget in axios v1.x where a polluted `Object.prototype.parseReviver` is passed to `JSON.parse(data, this.parseReviver)` at `lib/defaults/index.js:124`, enabling selective JSON response tampering. However, axios v0.19.2 does NOT contain this vulnerable code pattern. The target version uses `JSON.parse(data)` with NO reviver parameter at `lib/defaul...", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7c857ba6-676d-59f7-9cce-b100bc23f38c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:c10c185f-7d32-526a-ab61-a00f8d0d85cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1e0a1804-876c-5bbd-b230-ccb696cfc024", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:88067351-21be-5e8b-bdd4-2b4ffcf6ac97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:e458212d-8639-5efc-a597-fe7066523bdf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44489 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 CVE-2026-44489 describes a vulnerability specific to axios 1.15.2 where setProxy() reads proxy.username and proxy.password directly without hasOwnProperty checks, allowing prototype pollution to inject Proxy-Authorization headers. This code pattern never existed in axios 0.19.x. Version 0.19.2 uses a different architecture (proxy.auth.username/proxy.auth.password), and that path is protected by...", "justification": "code_not_present" } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:d84e042f-3a5b-5c97-9238-324800b694fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:be8aa001-8c65-5397-b77d-d7de868b06c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44492 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:2759a24e-bf17-5c5d-b039-6bb27aaa992a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1f7e5e76-4bd4-51ab-ac4b-00d899a29714", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:be925b85-617a-5aa8-a167-eafcd89cb44b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:a8d092e4-4384-5234-8ff8-3132df567da6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 axios 0.19.2 is not affected by CVE-2026-67312. The vulnerability exists in the formDataToJSON helper (lib/helpers/formDataToJSON.js) and the axios.formToJSON() API, which process attacker-controlled FormData field names with nested bracket-delimited segments. These features do not exist in axios 0.19.2 - they were introduced in axios v0.28.0 (May 2022), more than 2 years after the 0.19.2 relea...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:978aa3ba-4055-5169-b47c-0101ad6a438d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 The target is axios 0.19.2-tuxcare.7. It has no FormData-to-JSON conversion helper, no formToJSON public API, and no recursive path-building code. FormData passes through the default transformRequest unchanged, so the unbounded-recursion DoS cannot occur. Not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:fab405f9-8d5b-5ac2-a935-90cb9ce9e7d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:c0f2a70d-f24a-5376-b623-d700caea87cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ed75519d-7881-536a-95d7-53399f826524", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67316 affects version 0.19.2-tuxcare.6 of axios, and is fixed in 0.19.2-tuxcare.7." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:dc246bdc-a2c1-5a0e-b904-adda1993bd34", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 axios 0.19.2-tuxcare.7 has no fetch adapter. lib/adapters contains only http.js and xhr.js. The vulnerable getBodyLength/resolveBodyLength/trackStream code from lib/adapters/fetch.js does not exist, so the maxBodyLength bypass for ReadableStream bodies cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:24801a59-af08-5a52-98f9-75a4bd2ab655", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 Not affected. This repo is axios 0.19.2-tuxcare.7, which has no HTTP/2 support and no maxBodyLength option. The Node adapter (lib/adapters/http.js) never selects an http2 transport, and no httpVersion option is read. The vulnerable chain from the CVE (a streamed body sent over HTTP/2 skips the byte-counting wrapper) therefore does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:46e6b8ca-0112-5433-9b70-208691f87d7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:721d4e5a-3b4e-5524-b0c3-7aea702dc323", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:3011c991-d0ad-5d3b-87a7-5b782d948dd7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 0.19.2-tuxcare.6 of axios. not_affected \u2014 Axios 0.19.2 (tuxcare.7) predates lib/helpers/toFormData.js, the formSerializer.maxDepth guard, and the top-level '{}' metatoken JSON.stringify shortcut. CVE-2026-67321 is an incomplete fix of GHSA-62hf-57xw-28j9 in that 1.x-only code, and none of it exists in this tree. The only recursive serialization is plain JSON.stringify on object data (lib/defaults.js:50-52) and object params (lib/helper...", "justification": "code_not_present" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:a4ca4f78-d7bd-5154-9a39-dc965fc89cb0", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:150f3c51-638f-57e2-bfa7-51fc5029a296", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:3ceeaae1-ae22-5543-b2d1-f65b653be9b5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:21c1335e-2445-598f-aacf-caed774658cb", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:894416bd-07cd-55b4-8fbd-0fa784e0c303", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ed036de4-e613-5b7f-b384-4cf1fa1319cc", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:0ba4ea8c-072b-524c-a5aa-af83e3b976be", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.19.2-tuxcare.6 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:6332fcd1-69d8-5bdf-8e4e-7e95251a7944", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:bee22fc6-d36c-5de8-bdeb-d337b0333594", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f66e5724-e461-5f6f-85f8-708c1b2b4ca1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:229c8917-12a4-55ba-9d17-c0db542c0228", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.19.2-tuxcare.6." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ], "bom-ref": "urn:uuid:92eef727-eb5e-59dd-b1e6-107a50f3d1b5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.19.2-tuxcare.6 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.6" } ] }