{ "@id": "urn:uuid:1014c690-321d-4aa1-b900-a034c5189386", "role": "Document Creator", "author": "https://tuxcare.com", "version": 19, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:30:06.809386+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-28168 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1.", "vulnerability": { "name": "CVE-2020-28168" }, "action_statement": "Vulnerability CVE-2020-28168 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45857 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1.", "vulnerability": { "name": "CVE-2023-45857" }, "action_statement": "Vulnerability CVE-2023-45857 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.3.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 0.15.3.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 0.15.3 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62718 does not affect version 0.15.3 of axios. axios 0.15.3 has no no_proxy support at all (added upstream in 38de2525, first released in 0.19.0), so the no_proxy hostname-normalization matching loop this CVE bypasses does not exist; the proxy is resolved solely via getProxyForUrl() with no hostname matching.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62718" }, "impact_statement": "axios 0.15.3 has no no_proxy support at all (added upstream in 38de2525, first released in 0.19.0), so the no_proxy hostname-normalization matching loop this CVE bypasses does not exist; the proxy is resolved solely via getProxyForUrl() with no hostname matching." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-04T11:42:00.096965+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 0.15.3 of axios. not_affected \u2014 Target version 0.15.3 is not affected by CVE-2026-39865. The vulnerability exists in axios HTTP/2 session cleanup logic (Http2Sessions class), but HTTP/2 support was not added until much later (commit d676df77, not an ancestor of target SHA a1126d5f). Version 0.15.3 uses only HTTP/1.1 via Node.js http/https modules and follow-redirects. Exhaustive searches confirm no HTTP/2 code, no Http2Sessio...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 Target version 0.15.3 is not affected by CVE-2026-39865. The vulnerability exists in axios HTTP/2 session cleanup logic (Http2Sessions class), but HTTP/2 support was not added until much later (commit d676df77, not an ancestor of target SHA a1126d5f). Version 0.15.3 uses only HTTP/1.1 via Node.js http/https modules and follow-redirects. Exhaustive searches confirm no HTTP/2 code, no Http2Sessio..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-10-15T12:48:23.527340+00:00", "status_notes": "Vulnerability CVE-2026-40175 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.7.", "vulnerability": { "name": "CVE-2026-40175" }, "action_statement": "Vulnerability CVE-2026-40175 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42033 does not affect version 0.15.3 of axios. axios 0.15.3 contains none of the prototype-pollution gadgets the advisory lists: config.transport, the mergeConfig transformRequest/transformResponse reads and the other sinks were all introduced in 0.19.0 or later. The advisory's <= 0.31.0 range is a blanket range; every per-gadget scope starts above 0.15.3.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42033" }, "impact_statement": "axios 0.15.3 contains none of the prototype-pollution gadgets the advisory lists: config.transport, the mergeConfig transformRequest/transformResponse reads and the other sinks were all introduced in 0.19.0 or later. The advisory's <= 0.31.0 range is a blanket range; every per-gadget scope starts above 0.15.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42034 does not affect version 0.15.3 of axios. axios 0.15.3 has no config.maxBodyLength option (only maxContentLength, a response-size limit), and lib/adapters/http.js never sets options.maxBodyLength, so there is no request-body size limit to bypass. Confirmed with a PoC against 0.15.3.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42034" }, "impact_statement": "axios 0.15.3 has no config.maxBodyLength option (only maxContentLength, a response-size limit), and lib/adapters/http.js never sets options.maxBodyLength, so there is no request-body size limit to bypass. Confirmed with a PoC against 0.15.3." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42035 does not affect version 0.15.3 of axios. Version 0.15.3 is not affected by CVE-2026-42035. The vulnerability requires duck-type FormData checking combined with calling data.getHeaders() to merge polluted headers into requests. This code pattern was introduced in later Axios versions but does not exist in 0.15.3. The target uses a simple instanceof FormData check (no duck-typing) and never invokes data.getHeaders(). Plain objects passed as request data are JSON-stringified as the request body and cannot influence headers. Attack Vector Brief: INPUT=plain object with polluted Object.prototype; GOAL=arbitrary headers merged into request; DEFENSE=reject plain objects in FormData check AND ensure getHeaders is not inherited. Target architecture predates the vulnerable pattern entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42035" }, "impact_statement": "Version 0.15.3 is not affected by CVE-2026-42035. The vulnerability requires duck-type FormData checking combined with calling data.getHeaders() to merge polluted headers into requests. This code pattern was introduced in later Axios versions but does not exist in 0.15.3. The target uses a simple instanceof FormData check (no duck-typing) and never invokes data.getHeaders(). Plain objects passed as request data are JSON-stringified as the request body and cannot influence headers. Attack Vector Brief: INPUT=plain object with polluted Object.prototype; GOAL=arbitrary headers merged into request; DEFENSE=reject plain objects in FormData check AND ensure getHeaders is not inherited. Target architecture predates the vulnerable pattern entirely." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-10-15T12:49:59.116477+00:00", "status_notes": "Vulnerability CVE-2026-42036 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.7.", "vulnerability": { "name": "CVE-2026-42036" }, "action_statement": "Vulnerability CVE-2026-42036 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-04T12:13:00.045616+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 0.15.3 of axios. not_affected \u2014 Version 0.15.3 does not contain the vulnerable code. The formDataToStream.js module that performs multipart form-data body construction in Node.js (and contains the CRLF injection vulnerability) was only introduced in axios v1.3.0 (January 2023), approximately 7 years after the target version 0.15.3 (circa 2016). In version 0.15.3, axios delegates FormData handling to platform implementations (...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 Version 0.15.3 does not contain the vulnerable code. The formDataToStream.js module that performs multipart form-data body construction in Node.js (and contains the CRLF injection vulnerability) was only introduced in axios v1.3.0 (January 2023), approximately 7 years after the target version 0.15.3 (circa 2016). In version 0.15.3, axios delegates FormData handling to platform implementations (..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42038 does not affect version 0.15.3 of axios. The loopback-equivalence bug lives entirely inside the no_proxy matching loop of lib/adapters/http.js, and axios 0.15.3 has no no_proxy support (added upstream in 38de2525, first released in 0.19.0); neither the matching loop nor isLoopbackHost.js exists.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42038" }, "impact_statement": "The loopback-equivalence bug lives entirely inside the no_proxy matching loop of lib/adapters/http.js, and axios 0.15.3 has no no_proxy support (added upstream in 38de2525, first released in 0.19.0); neither the matching loop nor isLoopbackHost.js exists." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42039 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42039" }, "action_statement": "Vulnerability CVE-2026-42039 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 0.15.3 of axios. not_affected \u2014 Version 0.15.3 does not contain the vulnerable component lib/helpers/AxiosURLSearchParams.js, which was introduced in v1.0.0-alpha.1 (2022). The CVE describes a null byte injection vulnerability in the encode() function within AxiosURLSearchParams.js, specifically the charMap entry '%00': '\\x00' that reverses safe percent-encoding. This file and vulnerability pattern do not exist in 0.15.3. The...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 Version 0.15.3 does not contain the vulnerable component lib/helpers/AxiosURLSearchParams.js, which was introduced in v1.0.0-alpha.1 (2022). The CVE describes a null byte injection vulnerability in the encode() function within AxiosURLSearchParams.js, specifically the charMap entry '%00': '\\x00' that reverses safe percent-encoding. This file and vulnerability pattern do not exist in 0.15.3. The..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42041 does not affect version 0.15.3 of axios. not_affected \u2014 Version 0.15.3 is NOT AFFECTED by CVE-2026-42041. The vulnerability requires the mergeDirectKeys function (introduced in later axios versions ~1.x) which uses the `in` operator to check property existence, allowing prototype chain traversal. Version 0.15.3 uses a fundamentally different architecture: utils.merge() with a hasOwnProperty filter that has been present since the initial implementati...", "vulnerability": { "name": "CVE-2026-42041" }, "impact_statement": "not_affected \u2014 Version 0.15.3 is NOT AFFECTED by CVE-2026-42041. The vulnerability requires the mergeDirectKeys function (introduced in later axios versions ~1.x) which uses the `in` operator to check property existence, allowing prototype chain traversal. Version 0.15.3 uses a fundamentally different architecture: utils.merge() with a hasOwnProperty filter that has been present since the initial implementati..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 0.15.3 of axios. not_affected \u2014 Axios version 0.15.3 is NOT affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration property, which was introduced in versions after 0.15.3. This version uses a different XSRF implementation based on the `withCredentials` property (introduced in v0.8.1 per CHANGELOG). The vulnerable code component (lib/helpers/resolveConfig.js) and the `withXSRFToken` feature are...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 Axios version 0.15.3 is NOT affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration property, which was introduced in versions after 0.15.3. This version uses a different XSRF implementation based on the `withCredentials` property (introduced in v0.8.1 per CHANGELOG). The vulnerable code component (lib/helpers/resolveConfig.js) and the `withXSRFToken` feature are..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42043 does not affect version 0.15.3 of axios. Incomplete-fix follow-up to CVE-2026-42038: the affected code is lib/helpers/isLoopbackHost.js, called only from the no_proxy matching loop. axios 0.15.3 has neither \u2014 no_proxy support first shipped in 0.19.0.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42043" }, "impact_statement": "Incomplete-fix follow-up to CVE-2026-42038: the affected code is lib/helpers/isLoopbackHost.js, called only from the no_proxy matching loop. axios 0.15.3 has neither \u2014 no_proxy support first shipped in 0.19.0." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-04T12:06:33.064806+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 0.15.3 of axios. not_affected \u2014 Axios 0.15.3 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern does not exist in this version: (1) the parseReviver config option was introduced in axios >= 1.12.0 and does not exist in 0.15.3, (2) the JSON.parse call in lib/defaults.js:61 does not accept a reviver parameter, and (3) patch file CVE-2026-42033.patch explicitly confirms \"pars...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 Axios 0.15.3 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern does not exist in this version: (1) the parseReviver config option was introduced in axios >= 1.12.0 and does not exist in 0.15.3, (2) the JSON.parse call in lib/defaults.js:61 does not accept a reviver parameter, and (3) patch file CVE-2026-42033.patch explicitly confirms \"pars..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44487 does not affect version 0.15.3 of axios. not_affected \u2014 Axios version 0.15.3 is not affected by CVE-2026-44487. The vulnerability requires dynamic proxy re-resolution on redirect (a feature introduced in axios 0.27.2), which is absent from version 0.15.3. In this version, all redirects unconditionally reuse the same proxy configuration as the initial request, preventing the proxy credential leak scenario described in the CVE.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44487" }, "impact_statement": "not_affected \u2014 Axios version 0.15.3 is not affected by CVE-2026-44487. The vulnerability requires dynamic proxy re-resolution on redirect (a feature introduced in axios 0.27.2), which is absent from version 0.15.3. In this version, all redirects unconditionally reuse the same proxy configuration as the initial request, preventing the proxy credential leak scenario described in the CVE." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44489 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-44489" }, "action_statement": "Vulnerability CVE-2026-44489 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44490 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.6.", "vulnerability": { "name": "CVE-2026-44490" }, "action_statement": "Vulnerability CVE-2026-44490 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.6." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44492 does not affect version 0.15.3 of axios. not_affected \u2014 Target version 0.15.3-tuxcare.3 is NOT AFFECTED by CVE-2026-44492. The vulnerability requires the NO_PROXY environment variable mechanism to exist, which was not introduced until version 0.19.1 (commit 38de252, August 2018). The target version predates this feature entirely.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44492" }, "impact_statement": "not_affected \u2014 Target version 0.15.3-tuxcare.3 is NOT AFFECTED by CVE-2026-44492. The vulnerability requires the NO_PROXY environment variable mechanism to exist, which was not introduced until version 0.19.1 (commit 38de252, August 2018). The target version predates this feature entirely." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 0.15.3 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T22:31:00.135477+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 0.15.3 of axios. not_affected \u2014 CVE-2026-67312 concerns uncontrolled recursion in formDataToJSON when processing deeply nested FormData field names. The target axios version 0.15.3 predates the introduction of this feature (added in v0.27.2, May 2022, commit c008e57f). No formDataToJSON helper, no axios.formToJSON method, and no bracket-notation parsing logic exists in this version. FormData is passed directly to the browser'...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 CVE-2026-67312 concerns uncontrolled recursion in formDataToJSON when processing deeply nested FormData field names. The target axios version 0.15.3 predates the introduction of this feature (added in v0.27.2, May 2022, commit c008e57f). No formDataToJSON helper, no axios.formToJSON method, and no bracket-notation parsing logic exists in this version. FormData is passed directly to the browser'..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-06T21:07:00.068154+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 0.15.3 of axios. not_affected \u2014 The target is axios 0.15.3-tuxcare.8. It has no formDataToJSON helper, no formToJSON API, and no FormData-to-JSON request transform. The recursive nested-bracket parser behind CVE-2026-67313 was introduced in 0.28.0, so it does not exist here.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 The target is axios 0.15.3-tuxcare.8. It has no formDataToJSON helper, no formToJSON API, and no FormData-to-JSON request transform. The recursive nested-bracket parser behind CVE-2026-67313 was introduced in 0.28.0, so it does not exist here." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 0.15.3 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-06T21:24:36.806712+00:00", "status_notes": "Vulnerability CVE-2026-67315 does not affect version 0.15.3 of axios. not_affected \u2014 Not affected (Type A2). The flaw is that isLoopback() in lib/helpers/shouldBypassProxy.js omits 0.0.0.0, so NO_PROXY entries for localhost or 127.0.0.1 do not cover it. This target (axios 0.15.3-tuxcare.8) has no shouldBypassProxy.js, no isLoopback and no NO_PROXY handling anywhere in lib/. lib/adapters/http.js getProxyForUrl() reads only the _proxy environment variable and does no ho...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-67315" }, "impact_statement": "not_affected \u2014 Not affected (Type A2). The flaw is that isLoopback() in lib/helpers/shouldBypassProxy.js omits 0.0.0.0, so NO_PROXY entries for localhost or 127.0.0.1 do not cover it. This target (axios 0.15.3-tuxcare.8) has no shouldBypassProxy.js, no isLoopback and no NO_PROXY handling anywhere in lib/. lib/adapters/http.js getProxyForUrl() reads only the _proxy environment variable and does no ho..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-10-25T02:52:00.182649+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.8.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.8." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-06T21:12:49.807216+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 0.15.3 of axios. not_affected \u2014 Not affected. The target is axios 0.15.3-tuxcare.8, which has no fetch adapter. Only lib/adapters/http.js and lib/adapters/xhr.js exist. The vulnerable code (the fetch adapter's getBodyLength/resolveBodyLength and maxBodyLength check) is absent from the whole tree.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 Not affected. The target is axios 0.15.3-tuxcare.8, which has no fetch adapter. Only lib/adapters/http.js and lib/adapters/xhr.js exist. The vulnerable code (the fetch adapter's getBodyLength/resolveBodyLength and maxBodyLength check) is absent from the whole tree." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-06T21:15:07.675710+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 0.15.3 of axios. not_affected \u2014 axios 0.15.3-tuxcare.8 has no HTTP/2 transport and no maxBodyLength option, so the CVE-2026-67318 chain cannot occur. The Node adapter only uses http/https and follow-redirects, and it does not read an httpVersion option.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 axios 0.15.3-tuxcare.8 has no HTTP/2 transport and no maxBodyLength option, so the CVE-2026-67318 chain cannot occur. The Node adapter only uses http/https and follow-redirects, and it does not read an httpVersion option." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-10-15T12:49:59.116477+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.7.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 0.15.3 of axios, and is fixed in 0.15.3-tuxcare.7." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 0.15.3 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 0.15.3 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-06T21:30:06.809386+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 0.15.3 of axios. not_affected \u2014 Target is axios 0.15.3-tuxcare.8, a 0.x line that has no lib/helpers/toFormData.js, toURLEncodedForm.js or AxiosURLSearchParams.js. It also has no formSerializer.maxDepth guard and no top-level '{}' metatoken branch that calls JSON.stringify. The CVE concerns a bypass of a depth guard that was added in 1.15.0 and is bypassed by that branch. Neither the guard nor the bypass branch exists here. R...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Target is axios 0.15.3-tuxcare.8, a 0.x line that has no lib/helpers/toFormData.js, toURLEncodedForm.js or AxiosURLSearchParams.js. It also has no formSerializer.maxDepth guard and no top-level '{}' metatoken branch that calls JSON.stringify. The CVE concerns a bypass of a depth guard that was added in 1.15.0 and is bypassed by that branch. Neither the guard nor the bypass branch exists here. R..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.15.3 of axios.", "vulnerability": { "name": "GHSA-7q8q-rj6j-mhjq" }, "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.15.3 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.15.3.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.15.3", "identifiers": { "purl": "pkg:npm/axios@0.15.3" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.15.3 of axios.", "vulnerability": { "name": "GHSA-mmx7-hfxf-jppx" }, "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.15.3 of axios." } ] }