{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e105e664-b4e7-5bc7-a3e9-1bbb5bde3622", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.19.2-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/axios@0.19.2-tuxcare.7", "version": "0.19.2-tuxcare.7", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@0.19.2", "type": "library", "version": "0.19.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:44cdb6cc-9ba9-5c5c-a18d-83c91276d876", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:ffd6076b-95d5-503f-a430-1193af19db9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-28168 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:fcfe204d-db0a-5616-b2b2-95469e518ec6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-3749 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6d7978c9-d1ee-5d23-b449-165d4a5367fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0b4483fa-6f6b-59c4-98a6-4b6a981605c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39338 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8eeed2be-c29e-57b8-94cf-bdb929eaaf5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:e51d17fc-0b9f-5719-b208-3be22e0dcaa8", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:563ef048-0c9f-534f-8069-ae92a3e0dcc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9f8d4060-153c-51db-addf-f971f48c19d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:cff9743c-9ce7-5727-a23d-5a4d138dbba6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b22a1f3e-0cbc-58f0-bec4-065522041a69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:2e5a218c-1ed2-57d1-ae38-c21b7c8330fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8f7c5a03-6adc-5ab5-b187-4c438c27e7ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:38bdb8d9-19d8-53be-bfe1-86eba19e368b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:3d682872-f5da-52c8-881f-6dd35ddb4717", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:41d45af2-d0ec-5508-91d3-f73a96a41517", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:ed0cf9eb-517d-55ec-b157-88984d2abeeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6726f4b6-a8fc-5e10-89fe-321f10c3e247", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:3f4b930f-5314-5458-8765-8cfb6edb7f24", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:3939e4a4-1e41-5e92-b086-d3fa83637167", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:13debedc-f455-5ab2-a8d4-66ca1d338191", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:5af2c688-1d8d-5ff3-9a6e-917925ed11e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d36490b6-058d-573f-b382-a99bac54f47c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 Target axios 0.19.2-tuxcare.7 is NOT affected by CVE-2026-39865. The vulnerability exists in the Http2Sessions class session cleanup logic introduced with HTTP/2 support in axios 1.13.2 (October 2025). The target version (0.19.2) predates HTTP/2 support and contains no HTTP/2 code whatsoever. The vulnerable code pattern (continuing loop iteration after array.splice() in session cleanup) does no...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b543c72a-6705-54aa-af24-60b1d5a4caac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f7538f79-4368-5436-8931-4169faddc730", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:44a11e61-be9d-5761-a4a5-9167bf108330", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:cda3f018-1759-524f-bcd5-bb159dc5d43d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:580e63f0-82dc-5869-aaea-5faf921876bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a5fbea1b-3b8a-5c4f-b530-54bfe032faeb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 Version 0.19.2 is not affected by CVE-2026-42037. The vulnerable file lib/helpers/formDataToStream.js does not exist in this version. This module was introduced in axios v1.0.0+ (October 2022) to enable Node.js FormData support. Version 0.19.2 (January 2020) lacks FormData-to-multipart-stream conversion entirely; the http adapter rejects FormData objects with error \"Data after transformation mu...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:151a9dae-a7ef-5b8d-a92f-9082d8d53a22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6ee7de40-8389-533b-a6f6-b0fe34b2f807", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:95a60e12-982b-581c-8ac0-29a2a9d1d837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:dcd666eb-3cd8-53e6-a7e2-07df71b8d866", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:c1d00548-902d-504a-b123-6296332b0569", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:716c5930-d5b6-5edb-8b91-bfe7283c57bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42043 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0da608e5-1cb0-5228-8a07-3a5dc119537f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 CVE-2026-42044 describes a prototype pollution gadget in axios v1.x where a polluted `Object.prototype.parseReviver` is passed to `JSON.parse(data, this.parseReviver)` at `lib/defaults/index.js:124`, enabling selective JSON response tampering. However, axios v0.19.2 does NOT contain this vulnerable code pattern. The target version uses `JSON.parse(data)` with NO reviver parameter at `lib/defaul...", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:214b46dc-2ad0-5c9f-8ae8-78334f7a838b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:49e52382-eab1-5aa2-b19b-8d798abd31fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:99d008d1-7f10-5593-956b-9740729f3c5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:77ff9378-c00a-54fe-8e92-ebb5eba1c577", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a8495f65-4500-5297-8b91-2ecc47b3ebb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44489 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 CVE-2026-44489 describes a vulnerability specific to axios 1.15.2 where setProxy() reads proxy.username and proxy.password directly without hasOwnProperty checks, allowing prototype pollution to inject Proxy-Authorization headers. This code pattern never existed in axios 0.19.x. Version 0.19.2 uses a different architecture (proxy.auth.username/proxy.auth.password), and that path is protected by...", "justification": "code_not_present" } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:76eadbcc-1368-57d6-ad0e-ab7008a53232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:9d90c9be-966f-50c3-a7c1-880cded8cf7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44492 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:d9d1ee25-51dc-5b98-9845-42cab9df5073", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:ec6b22c9-318a-5de6-b6cd-01e00b92ba27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:f7fb3637-3a9e-5766-bc7d-1f9cf9db5abd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:75b15111-b67a-5a80-bdb4-ced992840b0c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 axios 0.19.2 is not affected by CVE-2026-67312. The vulnerability exists in the formDataToJSON helper (lib/helpers/formDataToJSON.js) and the axios.formToJSON() API, which process attacker-controlled FormData field names with nested bracket-delimited segments. These features do not exist in axios 0.19.2 - they were introduced in axios v0.28.0 (May 2022), more than 2 years after the 0.19.2 relea...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:3d365115-0cdb-59c8-806f-d1e946dc5722", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 The target is axios 0.19.2-tuxcare.7. It has no FormData-to-JSON conversion helper, no formToJSON public API, and no recursive path-building code. FormData passes through the default transformRequest unchanged, so the unbounded-recursion DoS cannot occur. Not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0df4cc57-560c-5f43-a98c-db1d6a807336", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8df7f7a7-f6b7-55a4-b9d1-2648d831994b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:6c35fdd1-377e-5e5a-bd3f-4889db35b97c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:764f1c16-0cd4-549e-9d0c-07c18d4e2ff3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 axios 0.19.2-tuxcare.7 has no fetch adapter. lib/adapters contains only http.js and xhr.js. The vulnerable getBodyLength/resolveBodyLength/trackStream code from lib/adapters/fetch.js does not exist, so the maxBodyLength bypass for ReadableStream bodies cannot occur.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:c920f08d-21e1-5f2b-a342-7f5d52a1ca48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 Not affected. This repo is axios 0.19.2-tuxcare.7, which has no HTTP/2 support and no maxBodyLength option. The Node adapter (lib/adapters/http.js) never selects an http2 transport, and no httpVersion option is read. The vulnerable chain from the CVE (a streamed body sent over HTTP/2 skips the byte-counting wrapper) therefore does not exist in this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:50e4f816-cf86-5639-a0f5-b8c3155ba31a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b4d8b718-7df8-527f-8aa9-3845870f1279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:0e1dc03b-4de5-5733-be4b-068c1c75cd64", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 0.19.2-tuxcare.7 of axios. not_affected \u2014 Axios 0.19.2 (tuxcare.7) predates lib/helpers/toFormData.js, the formSerializer.maxDepth guard, and the top-level '{}' metatoken JSON.stringify shortcut. CVE-2026-67321 is an incomplete fix of GHSA-62hf-57xw-28j9 in that 1.x-only code, and none of it exists in this tree. The only recursive serialization is plain JSON.stringify on object data (lib/defaults.js:50-52) and object params (lib/helper...", "justification": "code_not_present" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:b3a0bc27-f72b-5c4e-b81f-8dfc518dbad1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:a1be062b-8066-531b-828e-2a8b21b916a3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:789650e7-b3de-5976-b7c0-2f253e94fc26", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:7ed2df1d-5ab0-5df3-9559-28fa7cca2132", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:354fd779-eaec-5953-b62d-d271cce0c13e", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:8e405c12-8bbf-5d09-aa1e-aabccf1fd57f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:90b7058a-b2d0-5f13-8960-37953a2480af", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.19.2-tuxcare.7 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:43ad66ae-24d8-5226-889e-7dbd36f222ff", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:cd80afb4-2730-5598-a474-04519ba351da", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:09c7bde2-1144-5084-80bb-4eea8fec7470", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:bc14de02-38fd-51ef-9673-e6e79214fc79", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.19.2-tuxcare.7." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ], "bom-ref": "urn:uuid:7b65b1be-37b7-531d-b7b6-d4e0a642a093", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.19.2-tuxcare.7 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.19.2-tuxcare.7" } ] }