{ "@id": "urn:uuid:a630bdbe-e7be-488f-adce-77a4c8c42147", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:31:01.749683+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2020-28168 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2020-28168" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3749 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2021-3749" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45857 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2023-45857" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-10-20T09:34:00.177223+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.6.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.6." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27152 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2025-27152" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62718 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2025-62718" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25639 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-25639" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-04T11:49:47.810575+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 Target axios 0.19.2-tuxcare.7 is NOT affected by CVE-2026-39865. The vulnerability exists in the Http2Sessions class session cleanup logic introduced with HTTP/2 support in axios 1.13.2 (October 2025). The target version (0.19.2) predates HTTP/2 support and contains no HTTP/2 code whatsoever. The vulnerable code pattern (continuing loop iteration after array.splice() in session cleanup) does no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 Target axios 0.19.2-tuxcare.7 is NOT affected by CVE-2026-39865. The vulnerability exists in the Http2Sessions class session cleanup logic introduced with HTTP/2 support in axios 1.13.2 (October 2025). The target version (0.19.2) predates HTTP/2 support and contains no HTTP/2 code whatsoever. The vulnerable code pattern (continuing loop iteration after array.splice() in session cleanup) does no..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40175 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-40175" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42033 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42033" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42034 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42034" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42035 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42035" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42036 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42036" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-04T12:14:00.061372+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 Version 0.19.2 is not affected by CVE-2026-42037. The vulnerable file lib/helpers/formDataToStream.js does not exist in this version. This module was introduced in axios v1.0.0+ (October 2022) to enable Node.js FormData support. Version 0.19.2 (January 2020) lacks FormData-to-multipart-stream conversion entirely; the http adapter rejects FormData objects with error \"Data after transformation mu...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 Version 0.19.2 is not affected by CVE-2026-42037. The vulnerable file lib/helpers/formDataToStream.js does not exist in this version. This module was introduced in axios v1.0.0+ (October 2022) to enable Node.js FormData support. Version 0.19.2 (January 2020) lacks FormData-to-multipart-stream conversion entirely; the http adapter rejects FormData objects with error \"Data after transformation mu..." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42038 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42038" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42039 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42039" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42040 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42040" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42041 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42041" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42042 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42042" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42043 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42043" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-04T12:08:39.118992+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 CVE-2026-42044 describes a prototype pollution gadget in axios v1.x where a polluted `Object.prototype.parseReviver` is passed to `JSON.parse(data, this.parseReviver)` at `lib/defaults/index.js:124`, enabling selective JSON response tampering. However, axios v0.19.2 does NOT contain this vulnerable code pattern. The target version uses `JSON.parse(data)` with NO reviver parameter at `lib/defaul...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 CVE-2026-42044 describes a prototype pollution gadget in axios v1.x where a polluted `Object.prototype.parseReviver` is passed to `JSON.parse(data, this.parseReviver)` at `lib/defaults/index.js:124`, enabling selective JSON response tampering. However, axios v0.19.2 does NOT contain this vulnerable code pattern. The target version uses `JSON.parse(data)` with NO reviver parameter at `lib/defaul..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44486 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-44486" } }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44487 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-44487" } }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-04T12:57:37.901459+00:00", "status_notes": "Vulnerability CVE-2026-44489 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 CVE-2026-44489 describes a vulnerability specific to axios 1.15.2 where setProxy() reads proxy.username and proxy.password directly without hasOwnProperty checks, allowing prototype pollution to inject Proxy-Authorization headers. This code pattern never existed in axios 0.19.x. Version 0.19.2 uses a different architecture (proxy.auth.username/proxy.auth.password), and that path is protected by...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44489" }, "impact_statement": "not_affected \u2014 CVE-2026-44489 describes a vulnerability specific to axios 1.15.2 where setProxy() reads proxy.username and proxy.password directly without hasOwnProperty checks, allowing prototype pollution to inject Proxy-Authorization headers. This code pattern never existed in axios 0.19.x. Version 0.19.2 uses a different architecture (proxy.auth.username/proxy.auth.password), and that path is protected by..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44490 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44490" }, "action_statement": "Vulnerability CVE-2026-44490 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.5.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.5.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.5." }, { "status": "fixed", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44496 is fixed in version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-44496" } }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T22:32:10.863109+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 axios 0.19.2 is not affected by CVE-2026-67312. The vulnerability exists in the formDataToJSON helper (lib/helpers/formDataToJSON.js) and the axios.formToJSON() API, which process attacker-controlled FormData field names with nested bracket-delimited segments. These features do not exist in axios 0.19.2 - they were introduced in axios v0.28.0 (May 2022), more than 2 years after the 0.19.2 relea...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 axios 0.19.2 is not affected by CVE-2026-67312. The vulnerability exists in the formDataToJSON helper (lib/helpers/formDataToJSON.js) and the axios.formToJSON() API, which process attacker-controlled FormData field names with nested bracket-delimited segments. These features do not exist in axios 0.19.2 - they were introduced in axios v0.28.0 (May 2022), more than 2 years after the 0.19.2 relea..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-06T21:07:00.068154+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 The target is axios 0.19.2-tuxcare.7. It has no FormData-to-JSON conversion helper, no formToJSON public API, and no recursive path-building code. FormData passes through the default transformRequest unchanged, so the unbounded-recursion DoS cannot occur. Not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 The target is axios 0.19.2-tuxcare.7. It has no FormData-to-JSON conversion helper, no formToJSON public API, and no recursive path-building code. FormData passes through the default transformRequest unchanged, so the unbounded-recursion DoS cannot occur. Not affected." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67315 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-67315" }, "action_statement": "Vulnerability CVE-2026-67315 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-10-25T00:32:35.709153+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.7.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.7." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-06T21:14:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 axios 0.19.2-tuxcare.7 has no fetch adapter. lib/adapters contains only http.js and xhr.js. The vulnerable getBodyLength/resolveBodyLength/trackStream code from lib/adapters/fetch.js does not exist, so the maxBodyLength bypass for ReadableStream bodies cannot occur.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 axios 0.19.2-tuxcare.7 has no fetch adapter. lib/adapters contains only http.js and xhr.js. The vulnerable getBodyLength/resolveBodyLength/trackStream code from lib/adapters/fetch.js does not exist, so the maxBodyLength bypass for ReadableStream bodies cannot occur." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-06T21:18:00.083900+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 Not affected. This repo is axios 0.19.2-tuxcare.7, which has no HTTP/2 support and no maxBodyLength option. The Node adapter (lib/adapters/http.js) never selects an http2 transport, and no httpVersion option is read. The vulnerable chain from the CVE (a streamed body sent over HTTP/2 skips the byte-counting wrapper) therefore does not exist in this version.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 Not affected. This repo is axios 0.19.2-tuxcare.7, which has no HTTP/2 support and no maxBodyLength option. The Node adapter (lib/adapters/http.js) never selects an http2 transport, and no httpVersion option is read. The vulnerable chain from the CVE (a streamed body sent over HTTP/2 skips the byte-counting wrapper) therefore does not exist in this version." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.5.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 0.19.2-tuxcare.2 of axios, and is fixed in 0.19.2-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 0.19.2-tuxcare.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-06T21:31:01.749683+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 0.19.2-tuxcare.2 of axios. not_affected \u2014 Axios 0.19.2 (tuxcare.7) predates lib/helpers/toFormData.js, the formSerializer.maxDepth guard, and the top-level '{}' metatoken JSON.stringify shortcut. CVE-2026-67321 is an incomplete fix of GHSA-62hf-57xw-28j9 in that 1.x-only code, and none of it exists in this tree. The only recursive serialization is plain JSON.stringify on object data (lib/defaults.js:50-52) and object params (lib/helper...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Axios 0.19.2 (tuxcare.7) predates lib/helpers/toFormData.js, the formSerializer.maxDepth guard, and the top-level '{}' metatoken JSON.stringify shortcut. CVE-2026-67321 is an incomplete fix of GHSA-62hf-57xw-28j9 in that 1.x-only code, and none of it exists in this tree. The only recursive serialization is plain JSON.stringify on object data (lib/defaults.js:50-52) and object params (lib/helper..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "GHSA-7q8q-rj6j-mhjq" }, "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.19.2-tuxcare.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.19.2-tuxcare.2.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.19.2-tuxcare.2", "identifiers": { "purl": "pkg:npm/axios@0.19.2-tuxcare.2" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.19.2-tuxcare.2 of axios.", "vulnerability": { "name": "GHSA-mmx7-hfxf-jppx" }, "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.19.2-tuxcare.2 of axios." } ] }