{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4db3e27d-1573-5c71-9d94-bf18695ad822", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.26.1-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/axios@0.26.1-tuxcare.5", "version": "0.26.1-tuxcare.5", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@0.26.1", "type": "library", "version": "0.26.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:b03c7456-b96f-5fb2-8a52-0cf2d22d286c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:5842a5d8-ca20-54d0-bba1-bef3c8ab536b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-28168 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) does not affect axios 0.26.1-tuxcare.5. The upstream fix (commit c7329fefc890050edd51e40e469a154d0117fc55) was already present in the upstream v0.26.1 release that TuxCare onboarded. The fix introduces a beforeRedirect callback that ensures all HTTP redirects continue to route through the configured proxy, preventing attackers from bypassing pr...", "justification": "code_not_present" } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:df90973e-12e6-5695-aeae-49e64cb9e5bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:e83e61fb-5139-5d2c-afb6-a693a993d580", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:88896f4f-8128-54c7-92bf-27be8e04c08d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-39338 does not affect version 0.26.1-tuxcare.5 of axios. Version 0.26.1 is NOT affected by CVE-2024-39338. The vulnerability requires WHATWG URL constructor parsing (introduced in axios 1.x), which resolves protocol-relative URLs like `//host:port` by extracting hostname and port. Version 0.26.1 uses legacy Node.js `url.parse()`, which treats `//host:port` as a pathname string, not a URL. When `url.parse('//localhost:4667')` is called, it returns hostname=null and port=null (defaulting to localhost:80), preventing the SSRF attack. The attack chain from INPUT (protocol-relative URL) to GOAL (request to attacker-controlled host) is broken by the architectural difference in URL parsing.", "justification": "code_not_present" } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:d230675c-85a0-5f20-a319-f13a05a37f0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:38d7a6ad-f4da-5751-a1ae-9b9f204194f5", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:07283c96-e6cf-5b7a-b726-d0999824867d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:c1e386ba-9ede-5371-9b71-9cf6195c7ea0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:9da95756-0893-5967-9860-4ad2500c3603", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:c75f4a2e-a335-5267-a625-561d34fdfe44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:3a2f9ed8-af3b-5705-8073-894a40f00f83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:f2eb1647-02d1-59bf-8988-9c832a1496ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:480276ee-ae4e-5581-b302-5228856bedb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:62205c95-13e5-5d09-8b33-9a2065c1b021", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:9d63759b-bac8-5fc6-9f28-0b10ec49d78b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ff6ed945-bd19-58a2-83fc-aebb3ef8c3d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:65fe70f3-3bdb-54a9-9686-e0c2ffa3121f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:fde29e40-890e-5c6f-a818-67bac82cbb25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:a3f14f80-77bc-5af9-9d86-3e882ebfab93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:55f8e88a-79e0-57e3-88b9-233c0eefe795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:e691a209-4ab9-5c48-816e-cc8a60127ca7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:6be81e1d-d922-5602-b6ef-a960232c300b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 CVE-2026-39865 does not affect axios 0.26.1-tuxcare.5 because HTTP/2 support is completely absent from this version. The vulnerable Http2Sessions class and its session cleanup logic were introduced in much later versions (1.13.x). The target version uses only HTTP/1.x with follow-redirects library. Exhaustive searches confirmed zero HTTP/2 code exists in the codebase, and git ancestry verificat...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:fada0b9b-c4c1-5cae-b8ef-4e1f225c834a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:832dc6d9-afd4-5403-ab59-ae2398c4a801", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:4d2020ed-c1c8-5537-b665-116b107a64c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:0cc90720-9457-52ce-b39e-dcdba719d635", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:4da0cd62-dc9d-5ff4-a370-195f051a3950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:e4cc69d9-17d8-5792-a482-13c5c64ec906", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 axios v0.26.1 is NOT affected by CVE-2026-42037. The vulnerable code (lib/helpers/formDataToStream.js) does not exist in this version. The file was first introduced in v1.3.0 (January 31, 2023), approximately 11 months after v0.26.1 was released (March 8, 2022). In v0.26.1, FormData objects are passed through unchanged to native implementations (lib/defaults/index.js:55-62) rather than being se...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:37b9a44d-06e9-5838-97f0-277000ce353e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ae95400a-9d84-5bd4-8569-b294c5970cc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:9f033958-0042-5946-97e5-b08e92ba9e49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:24e777e4-81e0-59f6-8664-277c4b7836cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:46b2f8c8-6a03-5215-a2bf-0d3f63732901", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:c52003cf-86ca-5949-a6cb-c239f426bbd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42043 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:8cf2de62-88dd-5b8a-9651-d80bb8945d1d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 Version 0.26.1-tuxcare.5 is NOT AFFECTED by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable feature \u2014 JSON.parse with this.parseReviver parameter \u2014 was introduced in v1.12.0 (commit 2a9763426e, August 2025) and does not exist in this version. The target code at lib/defaults/index.js:86 uses JSON.parse(data) with NO reviver parameter, making the attack chain impossible. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ba38cb9c-a8fa-5c06-9b6d-15016f6c6b5b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:9a4245ee-45b4-5f01-a430-9488ebd59741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:1624144a-0ab6-546d-be95-ce2df269a837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:5516035d-f4c9-5cf2-adeb-2d60d1d098b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:95ed9055-ae47-5728-bd6e-e6310099507a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44489 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 Version 0.26.1 is not affected by CVE-2026-44489. The vulnerability requires code that reads proxy.username and proxy.password as direct properties of the proxy object (not nested under proxy.auth) without hasOwnProperty checks. This code pattern was introduced in later versions (1.15.x) and does not exist in version 0.26.1. The target only supports the proxy.auth.username/proxy.auth.password p...", "justification": "code_not_present" } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:88e5c560-d4d6-5c05-be6e-0956ffb64eb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:db3bda40-0b03-5de6-a44e-877cedff5fdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44492 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ffa33b38-7255-5d4a-92d0-5bb242520a59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:8d6c6b3d-386e-5d0a-994c-5e6f4aa67518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:db33eb04-c030-5ec5-ae3d-ba44961fa66c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:0ee52260-7003-5139-a3e6-ef65f84a1442", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 axios 0.26.1 is not affected by CVE-2026-67312. The vulnerability exists in the formDataToJSON functionality (exposed as axios.formToJSON() and used internally when serializing FormData with Content-Type: application/json) which parses bracket-delimited field names like `a[x][y][z]` and recursively builds nested objects via buildPath(). This functionality was introduced in version 0.28.0 or lat...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:06edf2cb-8790-541e-8b42-6699dd7ce608", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67313 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:57459cc1-6bc8-5e5c-9432-0206cb048d54", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:20e613c7-1d8e-5927-925a-74ab8fb0163b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:f1e16525-446a-5151-b292-c101ce88e766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:bbe6a5ce-f29b-57f7-965a-d8a0ecabe038", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 Target is axios 0.26.1-tuxcare.5. It has no fetch adapter (lib/adapters contains only http.js and xhr.js). The flaw described is missing maxBodyLength enforcement for ReadableStream bodies in lib/adapters/fetch.js, which does not exist here. The Node http adapter already enforces maxBodyLength for stream uploads.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:1edf9e33-8e03-5212-945e-4d750ecb09bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 Target is axios 0.26.1-tuxcare.5, which has no HTTP/2 transport (no httpVersion option, no http2Transport, no node:http2 use). The bypass needs the built-in HTTP/2 path, which skips both follow-redirects and the byte-counting wrapper. In this version, streamed uploads with a finite maxBodyLength are limited on every built-in transport, so the Goal (sending more than the cap) is not reachable. I...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:050af86e-8d30-5fc3-939a-f4b64a9e8d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:87aa07fd-0c90-5fa1-9eb1-4e2b1f8db5c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:1d6b06c5-68d4-55bd-8b30-6ed0c8de61c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 0.26.1-tuxcare.5 of axios. not_affected \u2014 Target is axios 0.26.1-tuxcare.5, an old architecture. The vulnerable `{}`-suffix JSON.stringify shortcut in toFormData's defaultVisitor/build()/formSerializer.maxDepth does not exist. lib/helpers/toFormData.js is a small recursive helper with no metaToken handling and no JSON.stringify, and nothing in lib/ calls it. Object data is never serialized to multipart or urlencoded form by transformRe...", "justification": "code_not_reachable" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:5c3ed257-2815-5dd3-84a1-7fc3f50eb833", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:85f7a9d0-f28d-5011-bf0b-7afd9591748d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:ac004628-8c9a-5a43-ab33-7bea00267c4d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:0914e473-4b40-5508-a37b-6fd7df962740", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:8438b040-b36f-5ce8-867e-8630a7dbf633", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:d7fba402-ad79-5b3b-9bf7-8de285790957", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:8df44a0d-56d8-53b7-b5e0-9153e065ae0a", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.26.1-tuxcare.5 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:e1ba769e-0882-530d-9fd1-dab65484c26d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:d09961e3-1f15-5be7-82fc-9094f5ae6e04", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:9e3c495d-3f18-5072-8b18-53faa152ea63", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:80788046-dd69-56bb-8bc8-8cae59cc93d9", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.26.1-tuxcare.5." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ], "bom-ref": "urn:uuid:1aa24c4b-bbf0-58d7-995e-c9c9068a557f", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.26.1-tuxcare.5 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.26.1-tuxcare.5" } ] }