{ "@id": "urn:uuid:6cbb77ec-4b58-4504-96b2-e6afd8bc43f2", "role": "Document Creator", "author": "https://tuxcare.com", "version": 32, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:31:01.749683+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability AIKIDO-2026-291630 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.1.", "vulnerability": { "name": "AIKIDO-2026-291630" }, "action_statement": "Vulnerability AIKIDO-2026-291630 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T11:13:00.100427+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 0.33.0 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via redirect bypass of proxy) is NOT present in axios 0.33.0-tuxcare.4. The vulnerability was fixed in the upstream release (commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto) before TuxCare onboarded this version. The fix adds a beforeRedirects.proxy callback (lib/adapters/http.js:212-216) that re-applies proxy configuration to all redirect requests, preve...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via redirect bypass of proxy) is NOT present in axios 0.33.0-tuxcare.4. The vulnerability was fixed in the upstream release (commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto) before TuxCare onboarded this version. The fix adds a beforeRedirects.proxy callback (lib/adapters/http.js:212-216) that re-applies proxy configuration to all redirect requests, preve..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T11:29:00.099932+00:00", "status_notes": "Vulnerability CVE-2023-45857 does not affect version 0.33.0 of axios. not_affected \u2014 CVE-2023-45857 is NOT present in the target (axios v0.33.0-tuxcare.4). The vulnerability allowed XSRF tokens to be leaked to cross-origin servers when withCredentials was enabled. The target contains the upstream fix (commit 2755df56) that introduced the withXSRFToken option and restricts XSRF header transmission to same-origin requests only. This fix was already present in the upstream release...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45857" }, "impact_statement": "not_affected \u2014 CVE-2023-45857 is NOT present in the target (axios v0.33.0-tuxcare.4). The vulnerability allowed XSRF tokens to be leaked to cross-origin servers when withCredentials was enabled. The target contains the upstream fix (commit 2755df56) that introduced the withXSRFToken option and restricts XSRF header transmission to same-origin requests only. This fix was already present in the upstream release..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.3.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 0.33.0.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T11:59:00.062955+00:00", "status_notes": "Vulnerability CVE-2025-62718 does not affect version 0.33.0 of axios. not_affected \u2014 The target axios 0.33.0-tuxcare.4 repository is NOT AFFECTED by CVE-2025-62718. The vulnerability involves hostname normalization bypass in NO_PROXY matching, allowing requests with trailing dots (localhost.) or IPv6 brackets ([::1]) to bypass NO_PROXY rules. However, the fix was already present in the upstream axios 0.33.0 release that TuxCare onboarded. The fix (commit 03cdfc99) adds a should...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62718" }, "impact_statement": "not_affected \u2014 The target axios 0.33.0-tuxcare.4 repository is NOT AFFECTED by CVE-2025-62718. The vulnerability involves hostname normalization bypass in NO_PROXY matching, allowing requests with trailing dots (localhost.) or IPv6 brackets ([::1]) to bypass NO_PROXY rules. However, the fix was already present in the upstream axios 0.33.0 release that TuxCare onboarded. The fix (commit 03cdfc99) adds a should..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-10-01T21:18:28.460680+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-10-01T21:18:28.460680+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 0.33.0 of axios, and is fixed in 0.33.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25639 does not affect version 0.33.0 of axios. already_fixed \u2014 CVE-2026-25639 is not exploitable in the target repository. The vendor patch d7ff1409c68168d3057fc3891f911b2b92616f9e has been backported to axios v0.33.0-tuxcare.2 and is present in the current main branch. Both lib/core/mergeConfig.js and lib/utils.js contain the necessary defenses that filter dangerous property keys (__proto__, constructor, prototype) before processing, preventing the TypeEr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-25639" }, "impact_statement": "already_fixed \u2014 CVE-2026-25639 is not exploitable in the target repository. The vendor patch d7ff1409c68168d3057fc3891f911b2b92616f9e has been backported to axios v0.33.0-tuxcare.2 and is present in the current main branch. Both lib/core/mergeConfig.js and lib/utils.js contain the necessary defenses that filter dangerous property keys (__proto__, constructor, prototype) before processing, preventing the TypeEr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T11:49:47.810575+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 0.33.0 of axios. not_affected \u2014 Target version 0.33.0 is not affected by CVE-2026-39865. The vulnerability exists in axios's HTTP/2 session cleanup logic (Http2Sessions class), but HTTP/2 support was not added to axios until v1.13.0 (commit d676df77). Version 0.33.0 predates this feature addition by many major versions. Exhaustive searches confirm no HTTP/2 code, no Http2Sessions class, no session management functions, and no...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 Target version 0.33.0 is not affected by CVE-2026-39865. The vulnerability exists in axios's HTTP/2 session cleanup logic (Http2Sessions class), but HTTP/2 support was not added to axios until v1.13.0 (commit d676df77). Version 0.33.0 predates this feature addition by many major versions. Exhaustive searches confirm no HTTP/2 code, no Http2Sessions class, no session management functions, and no..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:10:00.243861+00:00", "status_notes": "Vulnerability CVE-2026-40175 does not affect version 0.33.0 of axios. not_affected \u2014 The target (axios 0.33.0-tuxcare.4) is NOT AFFECTED by CVE-2026-40175. An upstream fix (commit 03cdfc99 by Jay) introduced sanitizeHeaderValue which removes CRLF characters (\\r\\n) from all header values in dispatchRequest before they reach HTTP adapters. This defense blocks the CVE's attack: even if Object.prototype is polluted with CRLF-containing values, sanitizeHeaderValue strips them before...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40175" }, "impact_statement": "not_affected \u2014 The target (axios 0.33.0-tuxcare.4) is NOT AFFECTED by CVE-2026-40175. An upstream fix (commit 03cdfc99 by Jay) introduced sanitizeHeaderValue which removes CRLF characters (\\r\\n) from all header values in dispatchRequest before they reach HTTP adapters. This defense blocks the CVE's attack: even if Object.prototype is polluted with CRLF-containing values, sanitizeHeaderValue strips them before..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:18:00.086689+00:00", "status_notes": "Vulnerability CVE-2026-42034 does not affect version 0.33.0 of axios. not_affected \u2014 The target Axios version 0.33.0-tuxcare.4 is not affected by CVE-2026-42034. The vulnerability (maxBodyLength bypass for stream uploads when maxRedirects=0) was fixed by upstream commit b0c632f36 authored by Jason Saayman on 2026-04-19, which predates the first TuxCare commit (2ca6bf1e on 2026-08-05). The fix was already present in the upstream release that TuxCare onboarded. The defense wraps ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42034" }, "impact_statement": "not_affected \u2014 The target Axios version 0.33.0-tuxcare.4 is not affected by CVE-2026-42034. The vulnerability (maxBodyLength bypass for stream uploads when maxRedirects=0) was fixed by upstream commit b0c632f36 authored by Jason Saayman on 2026-04-19, which predates the first TuxCare commit (2ca6bf1e on 2026-08-05). The fix was already present in the upstream release that TuxCare onboarded. The defense wraps ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:32:54.116067+00:00", "status_notes": "Vulnerability CVE-2026-42036 does not affect version 0.33.0 of axios. not_affected \u2014 The target (axios 0.33.0-tuxcare.4) is NOT affected by CVE-2026-42036. The vulnerability\u2014bypassing maxContentLength enforcement when responseType='stream'\u2014is not present because the fix was already included in the upstream release that TuxCare onboarded. The defense code exists at lib/adapters/http.js:588-629, where a Transform stream counts response bytes and aborts when maxContentLength is ex...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42036" }, "impact_statement": "not_affected \u2014 The target (axios 0.33.0-tuxcare.4) is NOT affected by CVE-2026-42036. The vulnerability\u2014bypassing maxContentLength enforcement when responseType='stream'\u2014is not present because the fix was already included in the upstream release that TuxCare onboarded. The defense code exists at lib/adapters/http.js:588-629, where a Transform stream counts response bytes and aborts when maxContentLength is ex..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:17:00.041916+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 0.33.0 of axios. not_affected \u2014 Version 0.33.0 is NOT AFFECTED by CVE-2026-42037. The vulnerable code (lib/helpers/formDataToStream.js) does not exist in this version. It was introduced in axios v1.10.0 (January 2023), well after v0.33.0. Version 0.33.0 uses a completely different architecture: it delegates FormData serialization to the external 'form-data' npm package via data.getHeaders() instead of implementing custom mult...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 Version 0.33.0 is NOT AFFECTED by CVE-2026-42037. The vulnerable code (lib/helpers/formDataToStream.js) does not exist in this version. It was introduced in axios v1.10.0 (January 2023), well after v0.33.0. Version 0.33.0 uses a completely different architecture: it delegates FormData serialization to the external 'form-data' npm package via data.getHeaders() instead of implementing custom mult..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:31:48.036864+00:00", "status_notes": "Vulnerability CVE-2026-42038 does not affect version 0.33.0 of axios. not_affected \u2014 Target axios 0.33.0-tuxcare.4 is NOT AFFECTED by CVE-2026-42038. The vulnerability (incomplete loopback address equivalence in no_proxy bypass logic) was already fixed in the upstream v0.33.0 release via commit 03cdfc99 (April 11, 2026), before TuxCare onboarded the project (August 5, 2026). The target implements loopback equivalence checking via isLoopbackHost() that treats localhost, 127.x.x....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42038" }, "impact_statement": "not_affected \u2014 Target axios 0.33.0-tuxcare.4 is NOT AFFECTED by CVE-2026-42038. The vulnerability (incomplete loopback address equivalence in no_proxy bypass logic) was already fixed in the upstream v0.33.0 release via commit 03cdfc99 (April 11, 2026), before TuxCare onboarded the project (August 5, 2026). The target implements loopback equivalence checking via isLoopbackHost() that treats localhost, 127.x.x...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:22:00.040188+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 0.33.0 of axios. not_affected \u2014 CVE-2026-42039 describes unbounded recursion in toFormData causing stack overflow with deeply nested objects. The target axios 0.33.0-tuxcare.4 already contains the maxDepth protection (default 100 levels) that prevents this vulnerability. The fix was added by upstream commit 4c4f07fabdb005f5430bab797f12b55e2ed5fb33 (\"fix: form data recursion (#10728)\") authored by jasonsaayman@gmail.com, which...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 CVE-2026-42039 describes unbounded recursion in toFormData causing stack overflow with deeply nested objects. The target axios 0.33.0-tuxcare.4 already contains the maxDepth protection (default 100 levels) that prevents this vulnerability. The fix was added by upstream commit 4c4f07fabdb005f5430bab797f12b55e2ed5fb33 (\"fix: form data recursion (#10728)\") authored by jasonsaayman@gmail.com, which..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:41:00.055908+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 0.33.0 of axios. not_affected \u2014 CVE-2026-42040 describes a null byte injection vulnerability in axios's AxiosURLSearchParams encoder, where a charMap entry '%00': '\\x00' reversed safe percent-encoding. The target repository (axios 0.33.0-tuxcare.4) is NOT AFFECTED because the vulnerable code pattern was removed by upstream commit 44bca902 (authored by jasonsaayman@gmail.com on 2026-04-16), which shipped in the upstream releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 CVE-2026-42040 describes a null byte injection vulnerability in axios's AxiosURLSearchParams encoder, where a charMap entry '%00': '\\x00' reversed safe percent-encoding. The target repository (axios 0.33.0-tuxcare.4) is NOT AFFECTED because the vulnerable code pattern was removed by upstream commit 44bca902 (authored by jasonsaayman@gmail.com on 2026-04-16), which shipped in the upstream releas..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:38:52.388866+00:00", "status_notes": "Vulnerability CVE-2026-42041 does not affect version 0.33.0 of axios. not_affected \u2014 The target is NOT AFFECTED. The vulnerability pattern (using `in` operator in mergeDirectKeys which traverses the prototype chain) is absent from the target code. The fix was introduced by upstream commit b52187f4 in axios v0.31.1, replacing `prop in config2` with `hasOwn(config2, prop)` calls. TuxCare onboarded v0.33.0, which already included this upstream fix. The vulnerable code pattern does...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42041" }, "impact_statement": "not_affected \u2014 The target is NOT AFFECTED. The vulnerability pattern (using `in` operator in mergeDirectKeys which traverses the prototype chain) is absent from the target code. The fix was introduced by upstream commit b52187f4 in axios v0.31.1, replacing `prop in config2` with `hasOwn(config2, prop)` calls. TuxCare onboarded v0.33.0, which already included this upstream fix. The vulnerable code pattern does..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:51:46.244247+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 0.33.0 of axios. not_affected \u2014 The target repository (axios 0.33.0-tuxcare.4) is NOT affected by CVE-2026-42042. The vulnerability\u2014truthy/falsy coercion in withXSRFToken config allowing prototype pollution to leak XSRF tokens cross-origin\u2014was already fixed in the upstream axios release before TuxCare onboarded this version. The fix (commit b0c632f3) by upstream maintainer jasonsaayman@gmail.com includes both hasOwnProperty c...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 The target repository (axios 0.33.0-tuxcare.4) is NOT affected by CVE-2026-42042. The vulnerability\u2014truthy/falsy coercion in withXSRFToken config allowing prototype pollution to leak XSRF tokens cross-origin\u2014was already fixed in the upstream axios release before TuxCare onboarded this version. The fix (commit b0c632f3) by upstream maintainer jasonsaayman@gmail.com includes both hasOwnProperty c..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:13:00.045616+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 0.33.0 of axios. not_affected \u2014 Target version 0.33.0 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern never existed in this version: parseReviver feature was introduced in v1.11+ (commit 2a976342), while this is v0.33.0. Additionally, the target already contains the structural defense (null-prototype config object via Object.create(null) in mergeConfig.js:18) that block...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 Target version 0.33.0 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern never existed in this version: parseReviver feature was introduced in v1.11+ (commit 2a976342), while this is v0.33.0. Additionally, the target already contains the structural defense (null-prototype config object via Object.create(null) in mergeConfig.js:18) that block..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:56:42.394644+00:00", "status_notes": "Vulnerability CVE-2026-44489 does not affect version 0.33.0 of axios. not_affected \u2014 CVE-2026-44489 describes a prototype pollution bypass in Axios 1.15.2 where nested objects created by utils.merge() inherit from Object.prototype, allowing polluted properties (Object.prototype.username/password) to inject attacker-controlled Proxy-Authorization headers. The target (axios 0.33.0-tuxcare.4) is NOT AFFECTED because the vulnerable code pattern is not present. Commit 2af6116a (May ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44489" }, "impact_statement": "not_affected \u2014 CVE-2026-44489 describes a prototype pollution bypass in Axios 1.15.2 where nested objects created by utils.merge() inherit from Object.prototype, allowing polluted properties (Object.prototype.username/password) to inject attacker-controlled Proxy-Authorization headers. The target (axios 0.33.0-tuxcare.4) is NOT AFFECTED because the vulnerable code pattern is not present. Commit 2af6116a (May ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-04T12:57:37.901459+00:00", "status_notes": "Vulnerability CVE-2026-44490 does not affect version 0.33.0 of axios. not_affected \u2014 axios 0.33.0-tuxcare.4 is NOT affected by CVE-2026-44490. The vulnerable code patterns described in the CVE (prototype pollution via plain-object literals in utils.merge and Object.defineProperty descriptors) do not exist in this version. The target already uses null-prototype objects (Object.create(null)) in lib/utils.js:335 and lib/core/mergeConfig.js:18, along with hasOwnProperty checks thro...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44490" }, "impact_statement": "not_affected \u2014 axios 0.33.0-tuxcare.4 is NOT affected by CVE-2026-44490. The vulnerable code patterns described in the CVE (prototype pollution via plain-object literals in utils.merge and Object.defineProperty descriptors) do not exist in this version. The target already uses null-prototype objects (Object.create(null)) in lib/utils.js:335 and lib/core/mergeConfig.js:18, along with hasOwnProperty checks thro..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 0.33.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T22:34:29.636715+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 0.33.0 of axios. not_affected \u2014 The target (axios 0.33.0-tuxcare.4) is NOT AFFECTED by CVE-2026-67312. The vulnerability involves uncontrolled recursion in formDataToJSON when processing FormData field names with thousands of nested bracket-delimited segments, causing stack exhaustion. The target contains the upstream fix (commit 1417285c69344bbcc6420a021f67dee0c6fedb2d, authored by jasonsaayman@gmail.com, June 11, 2026) whic...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 The target (axios 0.33.0-tuxcare.4) is NOT AFFECTED by CVE-2026-67312. The vulnerability involves uncontrolled recursion in formDataToJSON when processing FormData field names with thousands of nested bracket-delimited segments, causing stack exhaustion. The target contains the upstream fix (commit 1417285c69344bbcc6420a021f67dee0c6fedb2d, authored by jasonsaayman@gmail.com, June 11, 2026) whic..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T21:10:00.052557+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 0.33.0 of axios. not_affected \u2014 The target already contains the upstream depth-guard fix in lib/helpers/formDataToJSON.js. It came in the upstream 0.33.0 release (commit 1417285c, authored by upstream, before the first TuxCare commit). Over-deep FormData keys now raise AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED before the recursive buildPath runs.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 The target already contains the upstream depth-guard fix in lib/helpers/formDataToJSON.js. It came in the upstream 0.33.0 release (commit 1417285c, authored by upstream, before the first TuxCare commit). Over-deep FormData keys now raise AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED before the recursive buildPath runs." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T21:05:01.569157+00:00", "status_notes": "Vulnerability CVE-2026-67314 does not affect version 0.33.0 of axios. not_affected \u2014 The target is axios 0.33.0-tuxcare.4. Both Basic-auth code paths already read the auth username and password only if they are own properties, so polluted Object.prototype values are never used. The guard came from the upstream commit 1417285c (\"fix: improve request config handling (#11001)\", jasonsaayman@gmail.com). That commit is in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67314" }, "impact_statement": "not_affected \u2014 The target is axios 0.33.0-tuxcare.4. Both Basic-auth code paths already read the auth username and password only if they are own properties, so polluted Object.prototype values are never used. The guard came from the upstream commit 1417285c (\"fix: improve request config handling (#11001)\", jasonsaayman@gmail.com). That commit is in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T21:24:36.806712+00:00", "status_notes": "Vulnerability CVE-2026-67315 does not affect version 0.33.0 of axios. not_affected \u2014 The fix is already present in the target. lib/helpers/shouldBypassProxy.js isLoopbackHost() treats '0.0.0.0' as a local host, so NO_PROXY=localhost/127.0.0.1/::1 bypasses the proxy for http://0.0.0.0:/. The fix is upstream commit 1417285c (author jasonsaayman@gmail.com), which is in the upstream release that TuxCare onboarded, so this is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67315" }, "impact_statement": "not_affected \u2014 The fix is already present in the target. lib/helpers/shouldBypassProxy.js isLoopbackHost() treats '0.0.0.0' as a local host, so NO_PROXY=localhost/127.0.0.1/::1 bypasses the proxy for http://0.0.0.0:/. The fix is upstream commit 1417285c (author jasonsaayman@gmail.com), which is in the upstream release that TuxCare onboarded, so this is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T12:38:00.046326+00:00", "status_notes": "Vulnerability CVE-2026-67316 does not affect version 0.33.0 of axios. not_affected \u2014 axios 0.33.0 already contains the upstream fix for the prototype-pollution read gadgets (upstream commit 1417285c, \"fix: improve request config handling (#11001)\"). The bodyless aliases, the Node HTTP adapter and the XHR adapter all read `data`, `proxy` and `paramsSerializer` with own-property checks. That commit is in the upstream release that TuxCare onboarded, so the verdict is not_affected ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67316" }, "impact_statement": "not_affected \u2014 axios 0.33.0 already contains the upstream fix for the prototype-pollution read gadgets (upstream commit 1417285c, \"fix: improve request config handling (#11001)\"). The bodyless aliases, the Node HTTP adapter and the XHR adapter all read `data`, `proxy` and `paramsSerializer` with own-property checks. That commit is in the upstream release that TuxCare onboarded, so the verdict is not_affected ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T21:15:07.675710+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 0.33.0 of axios. not_affected \u2014 Target is axios 0.33.0-tuxcare.4, which has no fetch adapter. The vulnerable code, lib/adapters/fetch.js (getBodyLength, resolveBodyLength and the trackStream wrapper), does not exist here. Only the xhr and http adapters exist. The http adapter already enforces maxBodyLength for streamed uploads. The CVE itself lists versions before the fetch adapter as not affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 Target is axios 0.33.0-tuxcare.4, which has no fetch adapter. The vulnerable code, lib/adapters/fetch.js (getBodyLength, resolveBodyLength and the trackStream wrapper), does not exist here. Only the xhr and http adapters exist. The http adapter already enforces maxBodyLength for streamed uploads. The CVE itself lists versions before the fetch adapter as not affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T21:19:00.030345+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 0.33.0 of axios. not_affected \u2014 axios 0.33.0-tuxcare.4 has no HTTP/2 support: there is no httpVersion option or http2 transport anywhere in lib/. Stream uploads can only go through follow-redirects, which enforces maxBodyLength natively, or the native http/https transport, which has a byte-counting limiter. The unprotected HTTP/2 path from the CVE does not exist here.", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 axios 0.33.0-tuxcare.4 has no HTTP/2 support: there is no httpVersion option or http2 transport anywhere in lib/. Stream uploads can only go through follow-redirects, which enforces maxBodyLength natively, or the native http/https transport, which has a byte-counting limiter. The unprotected HTTP/2 path from the CVE does not exist here." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T12:38:58.250579+00:00", "status_notes": "Vulnerability CVE-2026-67319 does not affect version 0.33.0 of axios. not_affected \u2014 The target (axios 0.33.0-tuxcare.4) already has the upstream fix for nested-option prototype-pollution gadgets. Upstream commit 1417285c (\"fix: improve request config handling\", #11001) is an ancestor of HEAD and of the first TuxCare commit. The sinks for auth.username/password and paramsSerializer.encode/serialize read these fields only as own properties.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67319" }, "impact_statement": "not_affected \u2014 The target (axios 0.33.0-tuxcare.4) already has the upstream fix for nested-option prototype-pollution gadgets. Upstream commit 1417285c (\"fix: improve request config handling\", #11001) is an ancestor of HEAD and of the first TuxCare commit. The sinks for auth.username/password and paramsSerializer.encode/serialize read these fields only as own properties." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 0.33.0 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 0.33.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-06T21:31:01.749683+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 0.33.0 of axios. not_affected \u2014 Not affected. The target's lib/helpers/toFormData.js already calls assertValueDepth(value, 1) before JSON.stringify in the '{}' branch of defaultVisitor. That is the upstream fix, commit 1417285c, and it shipped in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Not affected. The target's lib/helpers/toFormData.js already calls assertValueDepth(value, 1) before JSON.stringify in the '{}' branch of defaultVisitor. That is the upstream fix, commit 1417285c, and it shipped in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.33.0", "identifiers": { "purl": "pkg:npm/axios@0.33.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.33.0.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." } ] }