{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:adb9f32b-30ad-5376-b8c9-20f76ae5b39e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.21.2", "type": "library", "bom-ref": "pkg:npm/axios@0.21.2", "version": "0.21.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:75798f50-3b47-56b7-a879-689655ce2c81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.21.2 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:2755a06d-192e-5f18-be9b-6ff90e075022", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-28168 does not affect version 0.21.2 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is not present in axios 0.21.2-tuxcare.3. The upstream vendor fixed this vulnerability in v0.21.1 (commit c7329fef \"Hotfix: Prevent SSRF\" by Daniel Lopretto), which predates the TuxCare baseline. The fix adds a beforeRedirect callback in the setProxy function that ensures HTTP redirects continue to route through the configured proxy, preventing...", "justification": "code_not_present" } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:97b01bf8-7599-5708-b345-b5b3ae29e2f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 0.21.2 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:3dcfae17-25ae-5108-94d8-01bd16f0af4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45857 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.4." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:52d651e7-9d41-5c6b-b269-83e8f7e76b2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39338 affects version 0.21.2 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:010ab67e-ea0b-5142-9f71-861add2bca13", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27152 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.4." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:0344d5eb-194a-541a-a148-9d76ec400a37", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.21.2." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:b9e84b66-bf04-5316-aefc-f2b4b3bf8d1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 0.21.2 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:2f608eca-d3ba-5a89-b82e-a5cacc30b32d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62718 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:6213425c-b36d-561b-9559-a9392db109d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:406da2e6-1744-5c03-886b-5cd860c23022", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:2fe83459-146b-5e4c-84ff-838b0b87f508", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:3b5dafb1-3439-50ff-a944-9d85fe1442b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:d970d05a-7e77-5fdc-9f36-842809b8620b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:fb41f0cc-3442-5071-bbd1-ceaed9dff177", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:26df2dbf-6491-5e62-a129-cfd199e25506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:fe2f85d4-23b3-5416-b573-d676bfb31cbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:11837ed9-36d3-58fb-93ff-5c683a0a1625", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:186df494-50d0-5787-bcd6-cfdfeb6cea0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:3d8bc877-cc02-5093-b580-b1b46a8dfaee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:a3be1c7a-4a4e-56b8-b741-fa7ab07c04b4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:09e5d9d0-e089-5cd8-a1ee-ed9eca1b6b68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25639 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:a2084aec-71ce-563c-8285-25a0d1204db2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.21.2 of axios. not_affected \u2014 Target version axios 0.21.2-tuxcare.3 is not affected by CVE-2026-39865. The vulnerability exists in HTTP/2 session cleanup logic, but HTTP/2 support was not introduced to axios until version 1.13.0 (October 2025). The target version predates HTTP/2 support by multiple major versions. The vulnerable Http2Sessions class and its session cleanup code do not exist in this version. Exhaustive reposi...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:46c3e5d6-e31c-59fe-ab02-4fe9f5e91e7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40175 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.4." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:5f6278c3-55a8-5a68-a515-76d083eee99d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42033 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.3." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:8ae97579-c8c4-5cd1-951b-1b6e41fc793d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42034 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:50ac5542-4232-5226-8c04-a5a652d4f9de", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42035 does not affect version 0.21.2 of axios. 0.21.2 http adapter has no FormData getHeaders() call; the gadget first appears in axios 0.27.0. Verified against the npm tarball (manual review 2026-10-26).", "justification": "code_not_present" } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:97f789b1-6214-58a8-80fe-693b2d35160f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42036 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:8299dea8-3519-5da5-8e18-8a88586cb6b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.21.2 of axios. not_affected \u2014 axios 0.21.2 is not affected by CVE-2026-42037. The vulnerability exists in lib/helpers/formDataToStream.js, which constructs multipart form-data bodies by interpolating blob .type properties into Content-Type headers without sanitizing CRLF characters. This file and feature were introduced in axios v1.3.0 (commit 6ac574e0, January 2023) and do not exist in axios 0.21.2. Version 0.21.2 delegate...", "justification": "code_not_present" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:4f91c226-1769-5d64-aa11-141989c56329", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42038 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:e44471d9-4ead-5e27-b7a4-3d4b778e4519", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42039 does not affect version 0.21.2 of axios. not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:04e8bfc8-46d0-5ac7-814f-be0e70d48643", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 0.21.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:6a88fb17-ea9e-5273-9268-0a9647d278e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42041 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.3." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:85ffb203-af74-51fe-9b8e-e8b48d86c945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 0.21.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear...", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:026f42f8-cac1-58d9-830d-ea4f41740988", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42043 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:d9a54890-beff-5baf-971b-864251710dac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.21.2 of axios. not_affected \u2014 Version 0.21.2-tuxcare.3 is NOT AFFECTED by CVE-2026-42044 because the parseReviver feature does not exist in this version. The vulnerable code pattern (JSON.parse with this.parseReviver parameter) was introduced in v1.12.0 (August 2025), while version 0.21.2 predates this feature. The current code at lib/defaults.js:74 calls JSON.parse(data) without any reviver parameter. Exhaustive search of ...", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:61974f54-7d00-56a1-899d-30b8c7731f30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:56faab86-6068-581e-8593-7d1e170aecf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44486 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:691ec47f-7b00-5ce9-a12e-25da77adc94b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44487 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:fd9ad3df-3a12-5b14-bf53-651f66969ffb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:a8425017-e641-586e-ba6b-43a6e9f4587a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44489 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:d859ed7f-c52f-5d24-9d21-33c38be8e8ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44490 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.1." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:04d9f62c-a5a3-5228-85f6-07c3e3b14ac7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44492 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:eaaf4177-22dd-5345-aaed-9976e586ef69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:166420c7-94fb-5609-8950-3b51d65a9e90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.3." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:22aa7972-2cab-56c3-9827-43d721a5b352", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44496 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.4." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:3205cbd9-cd13-5c95-87f8-f2980ba173dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.21.2 of axios. not_affected \u2014 The target (axios 0.21.2-tuxcare.3) is not affected by CVE-2026-67312. The vulnerable formDataToJSON functionality does not exist in this version. The CVE explicitly states affected versions start \"from 0.28.0 before 0.33.0\", and formDataToJSON was introduced in axios 0.28.0 (commit c008e57f, May 2022). Version 0.21.2 predates this feature entirely - it has no formDataToJSON.js file, no axios.f...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:e8f846e7-793a-559d-8110-3d1537784724", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 0.21.2 of axios. not_affected \u2014 Not affected. Axios 0.21.2 (tuxcare.4) has no formDataToJSON helper, no formToJSON API, and no FormData-to-JSON transform. The recursive nested-bracket parser from CVE-2026-67313 does not exist here.", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:4e40f242-94a8-5c45-9db9-3b76baa546f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:3a72d4bc-ecd8-5ed4-a3dd-f3c92e19ea6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:b9ab9196-22c3-5439-bd04-f0a896430618", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67316 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:df2332c2-1679-5039-85c2-ac3338006291", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.21.2 of axios. not_affected \u2014 Target is axios 0.21.2-tuxcare.4. It has no fetch adapter, only lib/adapters/http.js and xhr.js. The CVE concerns lib/adapters/fetch.js, which does not exist in this repo, so the unbounded-ReadableStream path cannot occur. The HTTP adapter's stream upload path, which the CVE says is not affected, also counts bytes and enforces maxBodyLength.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:f75ea55e-6fc8-55a6-9d61-27a978991cc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.21.2 of axios. not_affected \u2014 axios 0.21.2 has no HTTP/2 support (no http2 module or httpVersion option anywhere in lib/). Every transport it can select enforces maxBodyLength on stream bodies: follow-redirects enforces it on the default path, and a byte-counting Transform wrapper covers the native http/https path (maxRedirects: 0). The HTTP/2 transport that bypasses the cap in the CVE does not exist here.", "justification": "protected_at_runtime" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:a029ab52-412d-584c-b4b2-0f3b2ec05b2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67319 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.2." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:c27df8be-fdc8-598e-b8ab-9e78e89ebdba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.21.2 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:3cc6d575-42de-5077-a3d0-680ad24fe362", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 0.21.2 of axios. not_affected \u2014 Target is axios 0.21.2-tuxcare.4. It has none of the affected code: no lib/helpers/toFormData.js, no formSerializer/maxDepth, no `{}` metatoken handling, no AxiosURLSearchParams or toURLEncodedForm. The CVE is a bypass of a maxDepth guard that was added in 1.15.0, and 0.21.2 has neither the guard nor the bypassed code path.", "justification": "code_not_present" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:8d2f1066-2687-56cb-93bb-4a0a1be67f66", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.21.2." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:8217373e-0ecb-54a9-9b8e-762aa880574f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.21.2." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:bafa61a7-1c69-53de-8312-2fef78a7cde3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.21.2." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:1badc297-ccf9-5e14-a5f2-97ecf940bbd3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.21.2." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:efc61c6c-151c-5ebe-af47-9effa445f67e", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.21.2." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:fc7feed7-c475-578a-b9ec-05e405ac05fb", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.21.2." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:135d82f2-74af-57bc-a02c-c64e2538396e", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.21.2." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:d7f400cc-0175-54f5-8c56-597e20db44d5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.21.2." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:97064812-f197-59a5-9f23-90cb62469d7f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.21.2." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.21.2" } ], "bom-ref": "urn:uuid:a02f0357-4384-55aa-83ff-6f4960ed6246", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.21.2." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.21.2" } ] }