{ "@id": "urn:uuid:83e88119-88d5-4f0e-8198-0e1591897ff2", "role": "Document Creator", "author": "https://tuxcare.com", "version": 31, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:35:05.216685+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:35:07.434363+00:00", "status_notes": "Vulnerability CVE-2020-28168 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2020-28168" }, "action_statement": "Vulnerability CVE-2020-28168 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:35:07.434363+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:35:07.434363+00:00", "status_notes": "Vulnerability CVE-2023-45857 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2023-45857" }, "action_statement": "Vulnerability CVE-2023-45857 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:35:07.434363+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 0.19.0.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:28:00.245689+00:00", "status_notes": "Vulnerability CVE-2025-62718 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2025-62718" }, "action_statement": "Vulnerability CVE-2025-62718 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:28:00.245689+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 0.19.0 of axios. not_affected \u2014 The target repository (axios 0.19.0) is not affected by CVE-2026-39865. This version predates HTTP/2 support in axios and does not contain the vulnerable Http2Sessions class or its session cleanup logic. HTTP/2 support was added in commit d676df77 (\"feat(http): add HTTP2 support\"), which is not an ancestor of the target HEAD (77fc8a2485a3dd4fe8c7eeb82603f8beb38907a7). Exhaustive searches confir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 The target repository (axios 0.19.0) is not affected by CVE-2026-39865. This version predates HTTP/2 support in axios and does not contain the vulnerable Http2Sessions class or its session cleanup logic. HTTP/2 support was added in commit d676df77 (\"feat(http): add HTTP2 support\"), which is not an ancestor of the target HEAD (77fc8a2485a3dd4fe8c7eeb82603f8beb38907a7). Exhaustive searches confir..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:27:00.137143+00:00", "status_notes": "Vulnerability CVE-2026-40175 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-40175" }, "action_statement": "Vulnerability CVE-2026-40175 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:31:00.195387+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:30:28.806949+00:00", "status_notes": "Vulnerability CVE-2026-42034 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42034" }, "action_statement": "Vulnerability CVE-2026-42034 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:31:00.195387+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:30:28.806949+00:00", "status_notes": "Vulnerability CVE-2026-42036 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42036" }, "action_statement": "Vulnerability CVE-2026-42036 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-04T12:18:00.086689+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 0.19.0 of axios. not_affected \u2014 Axios 0.19.0 is not affected by CVE-2026-42037. The vulnerable code (lib/helpers/formDataToStream.js) does not exist in this version. This module was introduced in version 1.11.0+ (commit 6ac574e0, January 2023), which is 2653 commits after the 0.19.0 release (August 2019). Axios 0.19.0 does not implement its own multipart form-data encoding - it treats FormData as an opaque object and delegate...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 Axios 0.19.0 is not affected by CVE-2026-42037. The vulnerable code (lib/helpers/formDataToStream.js) does not exist in this version. This module was introduced in version 1.11.0+ (commit 6ac574e0, January 2023), which is 2653 commits after the 0.19.0 release (August 2019). Axios 0.19.0 does not implement its own multipart form-data encoding - it treats FormData as an opaque object and delegate..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:30:28.806949+00:00", "status_notes": "Vulnerability CVE-2026-42038 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42038" }, "action_statement": "Vulnerability CVE-2026-42038 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-16T11:41:00.106687+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 0.19.0 of axios. not_affected \u2014 Axios 0.19.0 is NOT affected by CVE-2026-42039. The vulnerable component (lib/helpers/toFormData.js with its unbounded recursive build() function) does not exist in this version. The file was introduced in v0.25.0, which was released after 0.19.0. In 0.19.0, nested objects are serialized using native JSON.stringify() rather than a custom recursive walker, so the specific vulnerability described...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 Axios 0.19.0 is NOT affected by CVE-2026-42039. The vulnerable component (lib/helpers/toFormData.js with its unbounded recursive build() function) does not exist in this version. The file was introduced in v0.25.0, which was released after 0.19.0. In 0.19.0, nested objects are serialized using native JSON.stringify() rather than a custom recursive walker, so the specific vulnerability described..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-16T12:34:00.753765+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 0.19.0 of axios. not_affected \u2014 Target axios v0.19.0 is not affected by CVE-2026-42040. The vulnerable component lib/helpers/AxiosURLSearchParams.js does not exist in this version. The AxiosURLSearchParams feature (containing the null byte reverse-encoding vulnerability) was introduced in axios v0.28.0, which is 9 minor versions after the target. Version 0.19.0 uses only buildURL.js for URL encoding, which does not contain th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 Target axios v0.19.0 is not affected by CVE-2026-42040. The vulnerable component lib/helpers/AxiosURLSearchParams.js does not exist in this version. The AxiosURLSearchParams feature (containing the null byte reverse-encoding vulnerability) was introduced in axios v0.28.0, which is 9 minor versions after the target. Version 0.19.0 uses only buildURL.js for URL encoding, which does not contain th..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:33:00.271638+00:00", "status_notes": "Vulnerability CVE-2026-42041 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42041" }, "action_statement": "Vulnerability CVE-2026-42041 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-16T12:18:00.165228+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 0.19.0 of axios. not_affected \u2014 Version 0.19.0 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option introduced in later versions of axios. Version 0.19.0 predates this feature and does not contain the vulnerable code path. Exhaustive searches confirm that `withXSRFToken` does not exist anywhere in this version - neither in source code, documentation, nor tests. The CVE explicit...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 Version 0.19.0 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option introduced in later versions of axios. Version 0.19.0 predates this feature and does not contain the vulnerable code path. Exhaustive searches confirm that `withXSRFToken` does not exist anywhere in this version - neither in source code, documentation, nor tests. The CVE explicit..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:33:00.271638+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-04T12:09:00.084439+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 0.19.0 of axios. not_affected \u2014 Axios version 0.19.0 is not affected by CVE-2026-42044. The vulnerability requires JSON.parse to be called with `this.parseReviver` as the second argument (line 124 in lib/defaults/index.js of v1.x), enabling prototype pollution exploitation. However, axios 0.19.0's transformResponse (lib/defaults.js:62) calls `JSON.parse(data)` without any reviver parameter. The parseReviver feature was introd...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 Axios version 0.19.0 is not affected by CVE-2026-42044. The vulnerability requires JSON.parse to be called with `this.parseReviver` as the second argument (line 124 in lib/defaults/index.js of v1.x), enabling prototype pollution exploitation. However, axios 0.19.0's transformResponse (lib/defaults.js:62) calls `JSON.parse(data)` without any reviver parameter. The parseReviver feature was introd..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:25:09.397202+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:25:09.397202+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44489 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44489" }, "action_statement": "Vulnerability CVE-2026-44489 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:24:00.141259+00:00", "status_notes": "Vulnerability CVE-2026-44490 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44490" }, "action_statement": "Vulnerability CVE-2026-44490 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:22:00.210457+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:23:00.585347+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:27:00.137143+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T22:32:51.353772+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 0.19.0 of axios. not_affected \u2014 Version 0.19.0 is not affected by CVE-2026-67312. The vulnerable formDataToJSON functionality (with recursive parsePropPath and buildPath functions that process deeply nested bracket-delimited FormData field names without depth limits) does not exist in this version. This feature was introduced later in the 1.0.0-alpha.1 series (May 2022), approximately 3 years after version 0.19.0 was released...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 Version 0.19.0 is not affected by CVE-2026-67312. The vulnerable formDataToJSON functionality (with recursive parsePropPath and buildPath functions that process deeply nested bracket-delimited FormData field names without depth limits) does not exist in this version. This feature was introduced later in the 1.0.0-alpha.1 series (May 2022), approximately 3 years after version 0.19.0 was released..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-06T21:06:37.716467+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 0.19.0 of axios. not_affected \u2014 Target is axios 0.19.0. It has no FormData-to-JSON conversion helper (formDataToJSON / formToJSON / buildPath) and no JSON transform of FormData, so deeply nested bracket field names never reach a recursive parser. The CVE itself says the helper only exists from 0.28.0 onward.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 Target is axios 0.19.0. It has no FormData-to-JSON conversion helper (formDataToJSON / formToJSON / buildPath) and no JSON transform of FormData, so deeply nested bracket field names never reach a recursive parser. The CVE itself says the helper only exists from 0.28.0 onward." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67315 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-67315" }, "action_statement": "Vulnerability CVE-2026-67315 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:21:00.158031+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-06T21:15:07.675710+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 0.19.0 of axios. not_affected \u2014 Target is axios 0.19.0 (same product as the CVE). It has no fetch adapter (lib/adapters contains only http.js and xhr.js), no WHATWG ReadableStream handling, and no axios-level maxBodyLength option. The flawed code path that CVE-2026-67317 describes (lib/adapters/fetch.js getBodyLength/resolveBodyLength/trackStream) does not exist here. The patch diff itself was not available (URL only), so the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 Target is axios 0.19.0 (same product as the CVE). It has no fetch adapter (lib/adapters contains only http.js and xhr.js), no WHATWG ReadableStream handling, and no axios-level maxBodyLength option. The flawed code path that CVE-2026-67317 describes (lib/adapters/fetch.js getBodyLength/resolveBodyLength/trackStream) does not exist here. The patch diff itself was not available (URL only), so the..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-06T21:20:00.118356+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 0.19.0 of axios. not_affected \u2014 axios 0.19.0 has no HTTP/2 support and no maxBodyLength config option, so the CVE-2026-67318 path (HTTP/2 stream upload bypassing maxBodyLength) does not exist. The only transports are http/https and follow-redirects.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 axios 0.19.0 has no HTTP/2 support and no maxBodyLength config option, so the CVE-2026-67318 path (HTTP/2 stream upload bypassing maxBodyLength) does not exist. The only transports are http/https and follow-redirects." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-15T13:20:00.281317+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 0.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 0.19.0 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 0.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-06T21:35:05.216685+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 0.19.0 of axios. not_affected \u2014 Target is axios 0.19.0, the same product but a much older line. The component this CVE concerns does not exist in it. There is no lib/helpers/toFormData.js, no toURLEncodedForm.js, no AxiosURLSearchParams.js, no formSerializer, no maxDepth guard and no top-level '{}' metatoken shortcut. The CVE is a bypass of a depth guard that axios 1.15.0 introduced. The vulnerable code path the patch hardens...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Target is axios 0.19.0, the same product but a much older line. The component this CVE concerns does not exist in it. There is no lib/helpers/toFormData.js, no toURLEncodedForm.js, no AxiosURLSearchParams.js, no formSerializer, no maxDepth guard and no top-level '{}' metatoken shortcut. The CVE is a bypass of a depth guard that axios 1.15.0 introduced. The vulnerable code path the patch hardens..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-10-26T13:58:14.625260+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.0", "identifiers": { "purl": "pkg:npm/axios@0.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.19.0.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." } ] }