{
  "@id": "urn:uuid:ef26d7a9-04c8-4cdf-83ee-17d080017501",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T21:27:46.185052+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2019-10742 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2019-10742"
      },
      "action_statement": "Vulnerability CVE-2019-10742 affects version 1.12.2 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-04T11:17:00.068347+00:00",
      "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.12.2 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on HTTP redirects) is not present in axios 1.12.2. The upstream fix (commit c7329fef, Nov 2020) that adds the beforeRedirects.proxy callback to re-apply proxy settings on redirects was already included in the upstream 1.12.2 release, 743 commits before TuxCare onboarded this version. The vulnerable pattern (missing redirect proxy re-application) does not ex...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28168"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on HTTP redirects) is not present in axios 1.12.2. The upstream fix (commit c7329fef, Nov 2020) that adds the beforeRedirects.proxy callback to re-apply proxy settings on redirects was already included in the upstream 1.12.2 release, 743 commits before TuxCare onboarded this version. The vulnerable pattern (missing redirect proxy re-application) does not ex..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2021-3749 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2021-3749"
      },
      "action_statement": "Vulnerability CVE-2021-3749 affects version 1.12.2 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-04T11:31:00.065492+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.12.2 of axios. not_affected \u2014 The target repository (axios v1.12.2) is NOT AFFECTED by CVE-2023-45857. The vulnerability, which allowed XSRF tokens to be leaked to cross-origin hosts when withCredentials was set, has been fixed by upstream commits that shipped in the v1.12.2 release. The vulnerable code pattern (automatic cross-origin XSRF token transmission via withCredentials bypass) is not present in the target.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "impact_statement": "not_affected \u2014 The target repository (axios v1.12.2) is NOT AFFECTED by CVE-2023-45857. The vulnerability, which allowed XSRF tokens to be leaked to cross-origin hosts when withCredentials was set, has been fixed by upstream commits that shipped in the v1.12.2 release. The vulnerable code pattern (automatic cross-origin XSRF token transmission via withCredentials bypass) is not present in the target."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2024-39338 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2024-39338"
      },
      "action_statement": "Vulnerability CVE-2024-39338 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "action_statement": "Vulnerability CVE-2025-27152 affects version 1.12.2 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "CVE-2025-54371"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-58754 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2025-58754"
      },
      "action_statement": "Vulnerability CVE-2025-58754 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "action_statement": "Vulnerability CVE-2025-62718 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101898 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101898"
      },
      "action_statement": "Vulnerability CVE-2026-101898 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101899 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101899"
      },
      "action_statement": "Vulnerability CVE-2026-101899 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-101900 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101900"
      },
      "action_statement": "Vulnerability CVE-2026-101900 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101901 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101901"
      },
      "action_statement": "Vulnerability CVE-2026-101901 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-101902 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101902"
      },
      "action_statement": "Vulnerability CVE-2026-101902 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101903 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101903"
      },
      "action_statement": "Vulnerability CVE-2026-101903 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-101904 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101904"
      },
      "action_statement": "Vulnerability CVE-2026-101904 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101905 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101905"
      },
      "action_statement": "Vulnerability CVE-2026-101905 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101906 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101906"
      },
      "action_statement": "Vulnerability CVE-2026-101906 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101907 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101907"
      },
      "action_statement": "Vulnerability CVE-2026-101907 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-101908 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101908"
      },
      "action_statement": "Vulnerability CVE-2026-101908 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101909 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101909"
      },
      "action_statement": "Vulnerability CVE-2026-101909 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "action_statement": "Vulnerability CVE-2026-25639 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-04T11:50:29.480277+00:00",
      "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.12.2 of axios. not_affected \u2014 Version 1.12.2 is not affected by CVE-2026-39865. The vulnerability exists in HTTP/2 session cleanup logic (Http2Sessions class), but HTTP/2 support was not added to axios until v1.13.0\u2014after this version. The entire vulnerable code pattern (session array cleanup loop with continued iteration after splice) is absent because the target version does not contain any HTTP/2 implementation. Exhausti...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39865"
      },
      "impact_statement": "not_affected \u2014 Version 1.12.2 is not affected by CVE-2026-39865. The vulnerability exists in HTTP/2 session cleanup logic (Http2Sessions class), but HTTP/2 support was not added to axios until v1.13.0\u2014after this version. The entire vulnerable code pattern (session array cleanup loop with continued iteration after splice) is absent because the target version does not contain any HTTP/2 implementation. Exhausti..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "action_statement": "Vulnerability CVE-2026-40175 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "action_statement": "Vulnerability CVE-2026-42033 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "action_statement": "Vulnerability CVE-2026-42034 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "action_statement": "Vulnerability CVE-2026-42035 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "action_statement": "Vulnerability CVE-2026-42036 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42037 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42037"
      },
      "action_statement": "Vulnerability CVE-2026-42037 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "action_statement": "Vulnerability CVE-2026-42038 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "action_statement": "Vulnerability CVE-2026-42039 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "action_statement": "Vulnerability CVE-2026-42040 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "action_statement": "Vulnerability CVE-2026-42041 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "action_statement": "Vulnerability CVE-2026-42042 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "action_statement": "Vulnerability CVE-2026-42043 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42044 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42044"
      },
      "action_statement": "Vulnerability CVE-2026-42044 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-42264 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-42264"
      },
      "action_statement": "Vulnerability CVE-2026-42264 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-44488 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44488"
      },
      "action_statement": "Vulnerability CVE-2026-44488 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44489 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44489"
      },
      "action_statement": "Vulnerability CVE-2026-44489 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44490"
      },
      "action_statement": "Vulnerability CVE-2026-44490 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "action_statement": "Vulnerability CVE-2026-44492 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-44494 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44494"
      },
      "action_statement": "Vulnerability CVE-2026-44494 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-67312 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67312"
      },
      "action_statement": "Vulnerability CVE-2026-67312 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-67313 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67313"
      },
      "action_statement": "Vulnerability CVE-2026-67313 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67314 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67314"
      },
      "action_statement": "Vulnerability CVE-2026-67314 affects version 1.12.2 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-06T21:27:46.185052+00:00",
      "status_notes": "Vulnerability CVE-2026-67315 does not affect version 1.12.2 of axios. not_affected \u2014 Axios 1.12.2 does not contain lib/helpers/shouldBypassProxy.js or its isLoopback() equivalence logic. That helper was added in 1.15.0, and the CVE is an omission in it (0.0.0.0 missing from the loopback set). This target selects env proxies with the proxy-from-env dependency (v1.1.0) via lib/adapters/http.js:89. That library matches NO_PROXY entries literally and has no loopback-equivalence fea...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-67315"
      },
      "impact_statement": "not_affected \u2014 Axios 1.12.2 does not contain lib/helpers/shouldBypassProxy.js or its isLoopback() equivalence logic. That helper was added in 1.15.0, and the CVE is an omission in it (0.0.0.0 missing from the loopback set). This target selects env proxies with the proxy-from-env dependency (v1.1.0) via lib/adapters/http.js:89. That library matches NO_PROXY entries literally and has no loopback-equivalence fea..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-67317 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67317"
      },
      "action_statement": "Vulnerability CVE-2026-67317 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-06T21:20:36.966893+00:00",
      "status_notes": "Vulnerability CVE-2026-67318 does not affect version 1.12.2 of axios. not_affected \u2014 axios 1.12.2 has no Node.js HTTP/2 support. There is no httpVersion option and no http2 transport, and a grep of lib/ and index.d.ts finds neither. The CVE's affected functionality (httpVersion: 2 streamed uploads bypassing maxBodyLength) cannot occur here. The default HTTP/1.1 path goes through follow-redirects, which enforces maxBodyLength. Caveat: the native-transport path (maxRedirects: 0) ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-67318"
      },
      "impact_statement": "not_affected \u2014 axios 1.12.2 has no Node.js HTTP/2 support. There is no httpVersion option and no http2 transport, and a grep of lib/ and index.d.ts finds neither. The CVE's affected functionality (httpVersion: 2 streamed uploads bypassing maxBodyLength) cannot occur here. The default HTTP/1.1 path goes through follow-redirects, which enforces maxBodyLength. Caveat: the native-transport path (maxRedirects: 0) ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-27T14:17:45.744496+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 1.12.2 of axios, and is fixed in 1.12.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67320 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67320"
      },
      "action_statement": "Vulnerability CVE-2026-67320 affects version 1.12.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67321 affects version 1.12.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67321"
      },
      "action_statement": "Vulnerability CVE-2026-67321 affects version 1.12.2 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-38gx-cfqf-f652"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-39j5-w47m-2gmv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-3mcp-22mf-vrw3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-4ww2-rjh2-xpv9"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-68jp-44vc-2x5h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-6hqm-hm2v-3p2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-9wx3-p993-35vp"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-f2r5-pqh9-r8f8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-fq2j-3j99-rx65"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.12.2",
          "identifiers": {
            "purl": "pkg:npm/axios@1.12.2"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.12.2.",
      "vulnerability": {
        "name": "GHSA-fqj3-h9pc-443h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    }
  ]
}