{
  "@id": "urn:uuid:6c4eeba3-3d1b-40bf-95db-fc7a45edfe39",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 17,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T21:31:01.749683+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2019-10742 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2019-10742"
      },
      "action_statement": "Vulnerability CVE-2019-10742 affects version 0.24.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-04T11:15:10.917209+00:00",
      "status_notes": "Vulnerability CVE-2020-28168 does not affect version 0.24.0 of axios. not_affected \u2014 CVE-2020-28168 affects axios 0.21.0 via SSRF through proxy bypass on redirects. The target version (0.24.0-tuxcare.5) contains the upstream fix commit c7329fefc890050edd51e40e469a154d0117fc55 authored by Daniel Lopretto in November 2020, which was shipped in the upstream 0.24.0 release before TuxCare onboarded it. The fix adds a beforeRedirect callback that re-applies proxy configuration to all...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28168"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-28168 affects axios 0.21.0 via SSRF through proxy bypass on redirects. The target version (0.24.0-tuxcare.5) contains the upstream fix commit c7329fefc890050edd51e40e469a154d0117fc55 authored by Daniel Lopretto in November 2020, which was shipped in the upstream 0.24.0 release before TuxCare onboarded it. The fix adds a beforeRedirect callback that re-applies proxy configuration to all..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2021-3749 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2021-3749"
      },
      "action_statement": "Vulnerability CVE-2021-3749 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "action_statement": "Vulnerability CVE-2023-45857 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-39338 does not affect version 0.24.0 of axios. Target version 0.24.0 is NOT affected by CVE-2024-39338. The vulnerability exists in axios 1.7.2+ which uses the WHATWG URL constructor (new URL()) that resolves protocol-relative URLs. The target uses the legacy Node.js url.parse() API which does not treat '//attacker.com' as protocol-relative, breaking the SSRF attack chain. Testing confirms url.parse('//attacker.com:8888') returns hostname=null (treated as pathname), causing HTTP requests to default to localhost instead of the attacker's server.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2024-39338"
      },
      "impact_statement": "Target version 0.24.0 is NOT affected by CVE-2024-39338. The vulnerability exists in axios 1.7.2+ which uses the WHATWG URL constructor (new URL()) that resolves protocol-relative URLs. The target uses the legacy Node.js url.parse() API which does not treat '//attacker.com' as protocol-relative, breaking the SSRF attack chain. Testing confirms url.parse('//attacker.com:8888') returns hostname=null (treated as pathname), causing HTTP requests to default to localhost instead of the attacker's server."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "action_statement": "Vulnerability CVE-2025-27152 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "CVE-2025-54371"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-58754 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2025-58754"
      },
      "action_statement": "Vulnerability CVE-2025-58754 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "action_statement": "Vulnerability CVE-2025-62718 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101898 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101898"
      },
      "action_statement": "Vulnerability CVE-2026-101898 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101899 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101899"
      },
      "action_statement": "Vulnerability CVE-2026-101899 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101900 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101900"
      },
      "action_statement": "Vulnerability CVE-2026-101900 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101901 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101901"
      },
      "action_statement": "Vulnerability CVE-2026-101901 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101902 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101902"
      },
      "action_statement": "Vulnerability CVE-2026-101902 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101903 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101903"
      },
      "action_statement": "Vulnerability CVE-2026-101903 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101904 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101904"
      },
      "action_statement": "Vulnerability CVE-2026-101904 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101905 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101905"
      },
      "action_statement": "Vulnerability CVE-2026-101905 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101906 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101906"
      },
      "action_statement": "Vulnerability CVE-2026-101906 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101907 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101907"
      },
      "action_statement": "Vulnerability CVE-2026-101907 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101908 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101908"
      },
      "action_statement": "Vulnerability CVE-2026-101908 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101909 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101909"
      },
      "action_statement": "Vulnerability CVE-2026-101909 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "action_statement": "Vulnerability CVE-2026-25639 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-04T11:49:47.810575+00:00",
      "status_notes": "Vulnerability CVE-2026-39865 does not affect version 0.24.0 of axios. not_affected \u2014 CVE-2026-39865 does NOT affect axios version 0.24.0-tuxcare.5. The vulnerability exists in the HTTP/2 session cleanup logic (Http2Sessions class) introduced in axios 1.x. Version 0.24.0 (released October 2021) predates the HTTP/2 feature entirely and contains no HTTP/2 session management code. The vulnerable code path\u2014array iteration continuing after in-place splice during session cleanup\u2014does ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39865"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-39865 does NOT affect axios version 0.24.0-tuxcare.5. The vulnerability exists in the HTTP/2 session cleanup logic (Http2Sessions class) introduced in axios 1.x. Version 0.24.0 (released October 2021) predates the HTTP/2 feature entirely and contains no HTTP/2 session management code. The vulnerable code path\u2014array iteration continuing after in-place splice during session cleanup\u2014does ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "action_statement": "Vulnerability CVE-2026-40175 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "action_statement": "Vulnerability CVE-2026-42033 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "action_statement": "Vulnerability CVE-2026-42034 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "action_statement": "Vulnerability CVE-2026-42035 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "action_statement": "Vulnerability CVE-2026-42036 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:15:15.720335+00:00",
      "status_notes": "Vulnerability CVE-2026-42037 does not affect version 0.24.0 of axios. not_affected \u2014 CVE-2026-42037 targets a CRLF injection vulnerability in axios's lib/helpers/formDataToStream.js (line 27), where value.type from Blob/File objects is interpolated into multipart Content-Type headers without sanitizing \\r\\n sequences. This file was introduced in axios v1.3.0 (commit 6ac574e0, January 2023). The target version 0.24.0 predates v1.3.0 and does not contain formDataToStream.js. Vers...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42037"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42037 targets a CRLF injection vulnerability in axios's lib/helpers/formDataToStream.js (line 27), where value.type from Blob/File objects is interpolated into multipart Content-Type headers without sanitizing \\r\\n sequences. This file was introduced in axios v1.3.0 (commit 6ac574e0, January 2023). The target version 0.24.0 predates v1.3.0 and does not contain formDataToStream.js. Vers..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "action_statement": "Vulnerability CVE-2026-42038 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "action_statement": "Vulnerability CVE-2026-42039 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "action_statement": "Vulnerability CVE-2026-42040 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "action_statement": "Vulnerability CVE-2026-42041 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "action_statement": "Vulnerability CVE-2026-42042 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "action_statement": "Vulnerability CVE-2026-42043 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42044 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42044"
      },
      "action_statement": "Vulnerability CVE-2026-42044 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42264 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42264"
      },
      "action_statement": "Vulnerability CVE-2026-42264 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44488 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44488"
      },
      "action_statement": "Vulnerability CVE-2026-44488 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44489 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44489"
      },
      "action_statement": "Vulnerability CVE-2026-44489 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44490"
      },
      "action_statement": "Vulnerability CVE-2026-44490 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-10-15T12:46:46.570482+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "action_statement": "Vulnerability CVE-2026-44492 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44494 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44494"
      },
      "action_statement": "Vulnerability CVE-2026-44494 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-10-15T12:46:46.570482+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T22:34:29.636715+00:00",
      "status_notes": "Vulnerability CVE-2026-67312 does not affect version 0.24.0 of axios. not_affected \u2014 axios 0.24.0 is NOT AFFECTED by CVE-2026-67312. The vulnerability exists in the formDataToJSON helper (lib/helpers/formDataToJSON.js) which parses FormData field names with bracket notation and performs unbounded recursion in parsePropPath() and buildPath() functions. This helper was introduced in a later axios version (commit c008e57f, after 0.24.0 release) and does not exist in the target cod...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-67312"
      },
      "impact_statement": "not_affected \u2014 axios 0.24.0 is NOT AFFECTED by CVE-2026-67312. The vulnerability exists in the formDataToJSON helper (lib/helpers/formDataToJSON.js) which parses FormData field names with bracket notation and performs unbounded recursion in parsePropPath() and buildPath() functions. This helper was introduced in a later axios version (commit c008e57f, after 0.24.0 release) and does not exist in the target cod..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-06T21:07:00.068154+00:00",
      "status_notes": "Vulnerability CVE-2026-67313 does not affect version 0.24.0 of axios. not_affected \u2014 axios 0.24.0-tuxcare.5 has no FormData-to-JSON conversion at all. formToJSON, formDataToJSON, parsePropPath and buildPath do not exist in the repo. FormData passed to a request is returned unchanged by transformRequest, so deeply nested field names are never parsed or recursed on. The CVE affects only axios 0.28.0 and later. The proxy-bypass text in the original report concerns shouldBypassProx...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-67313"
      },
      "impact_statement": "not_affected \u2014 axios 0.24.0-tuxcare.5 has no FormData-to-JSON conversion at all. formToJSON, formDataToJSON, parsePropPath and buildPath do not exist in the repo. FormData passed to a request is returned unchanged by transformRequest, so deeply nested field names are never parsed or recursed on. The CVE affects only axios 0.28.0 and later. The proxy-bypass text in the original report concerns shouldBypassProx..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-67314 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67314"
      },
      "action_statement": "Vulnerability CVE-2026-67314 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67315 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67315"
      },
      "action_statement": "Vulnerability CVE-2026-67315 affects version 0.24.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-10-15T12:48:23.527340+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-06T21:14:00.043521+00:00",
      "status_notes": "Vulnerability CVE-2026-67317 does not affect version 0.24.0 of axios. not_affected \u2014 axios 0.24.0-tuxcare.5 has no fetch adapter (lib/adapters/fetch.js, getBodyLength, trackStream), so the CVE-2026-67317 flaw cannot occur. Only the xhr and http adapters exist. The HTTP adapter counts stream bytes and enforces maxBodyLength, and the CVE says the HTTP adapter is not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-67317"
      },
      "impact_statement": "not_affected \u2014 axios 0.24.0-tuxcare.5 has no fetch adapter (lib/adapters/fetch.js, getBodyLength, trackStream), so the CVE-2026-67317 flaw cannot occur. Only the xhr and http adapters exist. The HTTP adapter counts stream bytes and enforces maxBodyLength, and the CVE says the HTTP adapter is not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-06T21:19:00.030345+00:00",
      "status_notes": "Vulnerability CVE-2026-67318 does not affect version 0.24.0 of axios. not_affected \u2014 axios 0.24.0 (TuxCare branch) has no HTTP/2 transport or httpVersion option, so the CVE's HTTP/2 bypass cannot occur. The built-in transports all enforce maxBodyLength on streamed uploads. follow-redirects enforces it on the default path, and an explicit byte-counting limiter enforces it when maxRedirects is 0.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-67318"
      },
      "impact_statement": "not_affected \u2014 axios 0.24.0 (TuxCare branch) has no HTTP/2 transport or httpVersion option, so the CVE's HTTP/2 bypass cannot occur. The built-in transports all enforce maxBodyLength on streamed uploads. follow-redirects enforces it on the default path, and an explicit byte-counting limiter enforces it when maxRedirects is 0."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-10-15T12:48:23.527340+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 0.24.0 of axios, and is fixed in 0.24.0-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67320 affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67320"
      },
      "action_statement": "Vulnerability CVE-2026-67320 affects version 0.24.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-06T21:31:01.749683+00:00",
      "status_notes": "Vulnerability CVE-2026-67321 does not affect version 0.24.0 of axios. not_affected \u2014 axios 0.24.0 (tuxcare) has no lib/helpers/toFormData.js, toURLEncodedForm, or AxiosURLSearchParams. The CVE's flaw is a top-level '{}' key shortcut in toFormData's defaultVisitor that calls JSON.stringify before the maxDepth guard in build() runs. That shortcut, and the maxDepth guard it bypasses, do not exist in this version. Object-to-FormData and object-to-urlencoded serialization are also a...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-67321"
      },
      "impact_statement": "not_affected \u2014 axios 0.24.0 (tuxcare) has no lib/helpers/toFormData.js, toURLEncodedForm, or AxiosURLSearchParams. The CVE's flaw is a top-level '{}' key shortcut in toFormData's defaultVisitor that calls JSON.stringify before the maxDepth guard in build() runs. That shortcut, and the maxDepth guard it bypasses, do not exist in this version. Object-to-FormData and object-to-urlencoded serialization are also a..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-38gx-cfqf-f652"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-39j5-w47m-2gmv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-3mcp-22mf-vrw3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-4ww2-rjh2-xpv9"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-68jp-44vc-2x5h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-6hqm-hm2v-3p2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "GHSA-7q8q-rj6j-mhjq"
      },
      "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.24.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-9wx3-p993-35vp"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-f2r5-pqh9-r8f8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-fq2j-3j99-rx65"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.24.0.",
      "vulnerability": {
        "name": "GHSA-fqj3-h9pc-443h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.24.0",
          "identifiers": {
            "purl": "pkg:npm/axios@0.24.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.24.0 of axios.",
      "vulnerability": {
        "name": "GHSA-mmx7-hfxf-jppx"
      },
      "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.24.0 of axios."
    }
  ]
}