{
  "@id": "urn:uuid:014c44a5-9f60-41b8-8c42-f0404f938cd4",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 29,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-04T12:56:42.394644+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2019-10742 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2019-10742"
      },
      "action_statement": "Vulnerability CVE-2019-10742 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T11:17:00.068347+00:00",
      "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.16.0 of axios. not_affected \u2014 CVE-2020-28168 is not present in axios 1.16.0-tuxcare.3. The vulnerability allowed proxy bypass via HTTP redirects, but the fix was already included in the upstream axios 1.16.0 release before TuxCare onboarded it. The defense code (options.beforeRedirects.proxy callback at lib/adapters/http.js:316-320) ensures redirects also go through the configured proxy, preventing the SSRF attack.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28168"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-28168 is not present in axios 1.16.0-tuxcare.3. The vulnerability allowed proxy bypass via HTTP redirects, but the fix was already included in the upstream axios 1.16.0 release before TuxCare onboarded it. The defense code (options.beforeRedirects.proxy callback at lib/adapters/http.js:316-320) ensures redirects also go through the configured proxy, preventing the SSRF attack."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2021-3749 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2021-3749"
      },
      "action_statement": "Vulnerability CVE-2021-3749 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T11:28:19.453347+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.16.0 of axios. not_affected \u2014 Target axios 1.16.0-tuxcare.3 is NOT AFFECTED by CVE-2023-45857. The vulnerability (XSRF tokens sent to cross-origin destinations) was fixed in upstream commit 1728aa1b1 by enforcing strict same-origin validation. This fix was already present in the upstream release v1.16.0 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fe17338c.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "impact_statement": "not_affected \u2014 Target axios 1.16.0-tuxcare.3 is NOT AFFECTED by CVE-2023-45857. The vulnerability (XSRF tokens sent to cross-origin destinations) was fixed in upstream commit 1728aa1b1 by enforcing strict same-origin validation. This fix was already present in the upstream release v1.16.0 that TuxCare onboarded, as confirmed by the fix commit being an ancestor of the first TuxCare commit fe17338c."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2024-39338 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2024-39338"
      },
      "action_statement": "Vulnerability CVE-2024-39338 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "action_statement": "Vulnerability CVE-2025-27152 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "CVE-2025-54371"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-58754 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2025-58754"
      },
      "action_statement": "Vulnerability CVE-2025-58754 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T11:56:00.065795+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 does not affect version 1.16.0 of axios. not_affected \u2014 CVE-2025-62718 describes a hostname normalization bypass in Axios NO_PROXY checking where non-normalized hostnames (e.g., 'localhost.' with trailing dot or '[::1]' IPv6 literal) skip NO_PROXY matching and are incorrectly proxied. The target repository (axios 1.16.0-tuxcare.3) is NOT AFFECTED because the upstream fix (commit fb3befb6daac6cad26b2e54094d0f2d9e47f24df by jasonsaayman@gmail.com) is ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-62718 describes a hostname normalization bypass in Axios NO_PROXY checking where non-normalized hostnames (e.g., 'localhost.' with trailing dot or '[::1]' IPv6 literal) skip NO_PROXY matching and are incorrectly proxied. The target repository (axios 1.16.0-tuxcare.3) is NOT AFFECTED because the upstream fix (commit fb3befb6daac6cad26b2e54094d0f2d9e47f24df by jasonsaayman@gmail.com) is ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-10T21:22:00.089984+00:00",
      "status_notes": "Vulnerability CVE-2026-101898 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-101898"
      },
      "action_statement": "Vulnerability CVE-2026-101898 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-16T23:27:00.100460+00:00",
      "status_notes": "Vulnerability CVE-2026-101899 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101899"
      },
      "action_statement": "Vulnerability CVE-2026-101899 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-16T23:27:00.100460+00:00",
      "status_notes": "Vulnerability CVE-2026-101900 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101900"
      },
      "action_statement": "Vulnerability CVE-2026-101900 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-16T23:27:00.100460+00:00",
      "status_notes": "Vulnerability CVE-2026-101901 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101901"
      },
      "action_statement": "Vulnerability CVE-2026-101901 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-10T21:22:00.089984+00:00",
      "status_notes": "Vulnerability CVE-2026-101902 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-101902"
      },
      "action_statement": "Vulnerability CVE-2026-101902 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101903 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101903"
      },
      "action_statement": "Vulnerability CVE-2026-101903 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-10T21:23:00.081339+00:00",
      "status_notes": "Vulnerability CVE-2026-101904 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-101904"
      },
      "action_statement": "Vulnerability CVE-2026-101904 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-16T23:27:00.100460+00:00",
      "status_notes": "Vulnerability CVE-2026-101905 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101905"
      },
      "action_statement": "Vulnerability CVE-2026-101905 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-10T21:22:00.089984+00:00",
      "status_notes": "Vulnerability CVE-2026-101906 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-101906"
      },
      "action_statement": "Vulnerability CVE-2026-101906 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101907 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101907"
      },
      "action_statement": "Vulnerability CVE-2026-101907 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-10T21:23:00.081339+00:00",
      "status_notes": "Vulnerability CVE-2026-101908 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-101908"
      },
      "action_statement": "Vulnerability CVE-2026-101908 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-10T21:22:00.089984+00:00",
      "status_notes": "Vulnerability CVE-2026-101909 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-101909"
      },
      "action_statement": "Vulnerability CVE-2026-101909 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "action_statement": "Vulnerability CVE-2026-25639 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T11:49:47.810575+00:00",
      "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.16.0 of axios. not_affected \u2014 The target repository (axios 1.16.0-tuxcare.3) is NOT AFFECTED by CVE-2026-39865. The vulnerability pattern (array iteration continuing after splice modification) is not present in the current code. The fix was already included in the upstream axios release that TuxCare onboarded, applied by upstream author Dmitriy Mozgovoy on November 4, 2025, nearly a year before TuxCare's first work on this ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39865"
      },
      "impact_statement": "not_affected \u2014 The target repository (axios 1.16.0-tuxcare.3) is NOT AFFECTED by CVE-2026-39865. The vulnerability pattern (array iteration continuing after splice modification) is not present in the current code. The fix was already included in the upstream axios release that TuxCare onboarded, applied by upstream author Dmitriy Mozgovoy on November 4, 2025, nearly a year before TuxCare's first work on this ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:06:25.633063+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 does not affect version 1.16.0 of axios. not_affected \u2014 CVE-2026-40175 (CRLF header injection enabling HTTP request structure manipulation) is NOT present in axios 1.16.0-tuxcare.3. The target contains an upstream vendor fix (commit 163da722) that sanitizes header values by removing all invalid characters including \\r and \\n, preventing CRLF injection attacks. This fix was already present in the upstream release v1.16.0 before TuxCare onboarded it.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-40175 (CRLF header injection enabling HTTP request structure manipulation) is NOT present in axios 1.16.0-tuxcare.3. The target contains an upstream vendor fix (commit 163da722) that sanitizes header values by removing all invalid characters including \\r and \\n, preventing CRLF injection attacks. This fix was already present in the upstream release v1.16.0 before TuxCare onboarded it."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "action_statement": "Vulnerability CVE-2026-42033 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:23:00.154087+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.16.0 of axios. not_affected \u2014 CVE-2026-42034 is not present in axios 1.16.0-tuxcare.3. The vulnerability (maxBodyLength bypass for streamed uploads when maxRedirects=0) was already fixed by the upstream axios maintainer in commit 1c7f6d76 (\"fix: enforce max body length when max redirects is 0\"), which shipped in the upstream v1.16.0 release before TuxCare onboarded this version. The fix adds byte-counting Transform streams ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42034 is not present in axios 1.16.0-tuxcare.3. The vulnerability (maxBodyLength bypass for streamed uploads when maxRedirects=0) was already fixed by the upstream axios maintainer in commit 1c7f6d76 (\"fix: enforce max body length when max redirects is 0\"), which shipped in the upstream v1.16.0 release before TuxCare onboarded this version. The fix adds byte-counting Transform streams ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "action_statement": "Vulnerability CVE-2026-42035 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:33:00.558159+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.16.0 of axios. not_affected \u2014 CVE-2026-42036 describes a vulnerability where Axios with responseType='stream' bypasses maxContentLength enforcement, allowing unbounded response consumption. The target (axios 1.16.0-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit e8904af0) was already included in the upstream release before TuxCare onboarding. The fix at lib/adapters/http.js:992-1018 wraps streamed respons...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42036 describes a vulnerability where Axios with responseType='stream' bypasses maxContentLength enforcement, allowing unbounded response consumption. The target (axios 1.16.0-tuxcare.3) is NOT AFFECTED because the upstream vendor fix (commit e8904af0) was already included in the upstream release before TuxCare onboarding. The fix at lib/adapters/http.js:992-1018 wraps streamed respons..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:14:00.061372+00:00",
      "status_notes": "Vulnerability CVE-2026-42037 does not affect version 1.16.0 of axios. not_affected \u2014 The target axios version 1.16.0-tuxcare.3 is NOT vulnerable to CVE-2026-42037 (CRLF injection in formDataToStream.js). The vulnerability has been fixed by upstream commit 75873270 authored by jasonsaayman@gmail.com, which was already present in the axios 1.16.0 upstream release before TuxCare's involvement. The fix adds CRLF sanitization (`.replace(/[\\r\\n]/g, '')`) to `value.type` before interp...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42037"
      },
      "impact_statement": "not_affected \u2014 The target axios version 1.16.0-tuxcare.3 is NOT vulnerable to CVE-2026-42037 (CRLF injection in formDataToStream.js). The vulnerability has been fixed by upstream commit 75873270 authored by jasonsaayman@gmail.com, which was already present in the axios 1.16.0 upstream release before TuxCare's involvement. The fix adds CRLF sanitization (`.replace(/[\\r\\n]/g, '')`) to `value.type` before interp..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:27:00.053879+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.16.0 of axios. not_affected \u2014 The target axios version 1.16.0-tuxcare.3 is NOT affected by CVE-2026-42038. The vulnerability (incomplete no_proxy hostname normalization allowing loopback alias bypass) was fixed in upstream commit 163da722, which shipped in the axios 1.16.0 release before TuxCare onboarding. The fix correctly implements loopback equivalence checking so that localhost, 127.0.0.1, and ::1 are treated as equiva...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "impact_statement": "not_affected \u2014 The target axios version 1.16.0-tuxcare.3 is NOT affected by CVE-2026-42038. The vulnerability (incomplete no_proxy hostname normalization allowing loopback alias bypass) was fixed in upstream commit 163da722, which shipped in the axios 1.16.0 release before TuxCare onboarding. The fix correctly implements loopback equivalence checking so that localhost, 127.0.0.1, and ::1 are treated as equiva..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:24:00.126665+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.16.0 of axios. not_affected \u2014 The target axios 1.16.0-tuxcare.3 is NOT AFFECTED by CVE-2026-42039. The depth limiting protection against unbounded recursion in toFormData was already present in the upstream axios v1.16.0 release (commit 85132ffba by jasonsaayman@gmail.com, April 15, 2026), which TuxCare onboarded. The vulnerable pattern (unbounded recursion with no depth limit) does not exist in the target code.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "impact_statement": "not_affected \u2014 The target axios 1.16.0-tuxcare.3 is NOT AFFECTED by CVE-2026-42039. The depth limiting protection against unbounded recursion in toFormData was already present in the upstream axios v1.16.0 release (commit 85132ffba by jasonsaayman@gmail.com, April 15, 2026), which TuxCare onboarded. The vulnerable pattern (unbounded recursion with no depth limit) does not exist in the target code."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:43:41.632918+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 does not affect version 1.16.0 of axios. not_affected \u2014 The target axios 1.16.0-tuxcare.3 is NOT affected by CVE-2026-42040. The vulnerable charMap entry `'%00': '\\x00'` that caused null byte reverse-encoding is absent from lib/helpers/AxiosURLSearchParams.js (lines 14-21). The upstream fix (commit 5266af94 by Jay) removed this entry before TuxCare onboarded the 1.16.0 release. The first TuxCare commit (fe17338c by ikuliashov@cloudlinux.com) has the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "impact_statement": "not_affected \u2014 The target axios 1.16.0-tuxcare.3 is NOT affected by CVE-2026-42040. The vulnerable charMap entry `'%00': '\\x00'` that caused null byte reverse-encoding is absent from lib/helpers/AxiosURLSearchParams.js (lines 14-21). The upstream fix (commit 5266af94 by Jay) removed this entry before TuxCare onboarded the 1.16.0 release. The first TuxCare commit (fe17338c by ikuliashov@cloudlinux.com) has the..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:43:51.854632+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.16.0 of axios. not_affected \u2014 CVE-2026-42041 (prototype pollution gadget in validateStatus merge) is NOT PRESENT in axios v1.16.0-tuxcare.3. The vulnerable code pattern (using `in` operator in mergeDirectKeys) was fixed upstream by commit 42eb721e on April 19, 2026, and included in the upstream axios v1.16.0 release (May 2, 2026). TuxCare onboarded v1.16.0 with the fix already present. Current code at lib/core/mergeConfig.j...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42041 (prototype pollution gadget in validateStatus merge) is NOT PRESENT in axios v1.16.0-tuxcare.3. The vulnerable code pattern (using `in` operator in mergeDirectKeys) was fixed upstream by commit 42eb721e on April 19, 2026, and included in the upstream axios v1.16.0 release (May 2, 2026). TuxCare onboarded v1.16.0 with the fix already present. Current code at lib/core/mergeConfig.j..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:51:00.043949+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.16.0 of axios. not_affected \u2014 CVE-2026-42042 is NOT present in axios v1.16.0-tuxcare.3. The vulnerability (truthy non-boolean values for withXSRFToken short-circuiting same-origin check) was fixed in upstream commit 1728aa1b by Jay (jasonsaayman@gmail.com) and was already included in the upstream release that TuxCare onboarded. The current code uses strict boolean comparison (withXSRFToken === true) preventing prototype pol...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42042 is NOT present in axios v1.16.0-tuxcare.3. The vulnerability (truthy non-boolean values for withXSRFToken short-circuiting same-origin check) was fixed in upstream commit 1728aa1b by Jay (jasonsaayman@gmail.com) and was already included in the upstream release that TuxCare onboarded. The current code uses strict boolean comparison (withXSRFToken === true) preventing prototype pol..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "action_statement": "Vulnerability CVE-2026-42043 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:10:00.243861+00:00",
      "status_notes": "Vulnerability CVE-2026-42044 does not affect version 1.16.0 of axios. not_affected \u2014 The target (axios v1.16.0-tuxcare.3) is NOT AFFECTED by CVE-2026-42044. The vulnerable pattern\u2014direct property access to `this.parseReviver` in JSON.parse() allowing prototype chain traversal\u2014is not present. Two upstream fixes shipped in v1.15.1 and v1.15.2 defend against this gadget: (1) lib/defaults/index.js:129 uses `own(this, 'parseReviver')` with hasOwnProperty check, returning undefined i...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42044"
      },
      "impact_statement": "not_affected \u2014 The target (axios v1.16.0-tuxcare.3) is NOT AFFECTED by CVE-2026-42044. The vulnerable pattern\u2014direct property access to `this.parseReviver` in JSON.parse() allowing prototype chain traversal\u2014is not present. Two upstream fixes shipped in v1.15.1 and v1.15.2 defend against this gadget: (1) lib/defaults/index.js:129 uses `own(this, 'parseReviver')` with hasOwnProperty check, returning undefined i..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42264 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42264"
      },
      "action_statement": "Vulnerability CVE-2026-42264 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44488 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44488"
      },
      "action_statement": "Vulnerability CVE-2026-44488 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:53:00.069359+00:00",
      "status_notes": "Vulnerability CVE-2026-44489 does not affect version 1.16.0 of axios. not_affected \u2014 Target version 1.16.0-tuxcare.3 is NOT AFFECTED by CVE-2026-44489. The upstream fix (commit 9d92bcd3 by Jay/jasonsaayman@gmail.com, dated 2026-05-02) shipped in the upstream Axios 1.16.0 release before TuxCare onboarded it. Both vulnerable functions\u2014setProxy() in lib/adapters/http.js and merge() in lib/utils.js\u2014contain the required hasOwnProperty checks to prevent prototype pollution attacks. T...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44489"
      },
      "impact_statement": "not_affected \u2014 Target version 1.16.0-tuxcare.3 is NOT AFFECTED by CVE-2026-44489. The upstream fix (commit 9d92bcd3 by Jay/jasonsaayman@gmail.com, dated 2026-05-02) shipped in the upstream Axios 1.16.0 release before TuxCare onboarded it. Both vulnerable functions\u2014setProxy() in lib/adapters/http.js and merge() in lib/utils.js\u2014contain the required hasOwnProperty checks to prevent prototype pollution attacks. T..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-04T12:56:42.394644+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 does not affect version 1.16.0 of axios. not_affected \u2014 The target (axios 1.16.0-tuxcare.3) is not affected by CVE-2026-44490. The upstream fix commits (9d92bcd32639d1eea5b89f03ae45f248d3bb058e, 47915144662f2733e6c051bdcb895a8c8f0586aa, 28c721588c7a77e7503d0a434e016f852c597b57) that address both prototype-pollution gadgets were already present in the upstream release (axios 1.16.0) when TuxCare onboarded it. Both vulnerabilities are fixed: (A) heade...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44490"
      },
      "impact_statement": "not_affected \u2014 The target (axios 1.16.0-tuxcare.3) is not affected by CVE-2026-44490. The upstream fix commits (9d92bcd32639d1eea5b89f03ae45f248d3bb058e, 47915144662f2733e6c051bdcb895a8c8f0586aa, 28c721588c7a77e7503d0a434e016f852c597b57) that address both prototype-pollution gadgets were already present in the upstream release (axios 1.16.0) when TuxCare onboarded it. Both vulnerabilities are fixed: (A) heade..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "action_statement": "Vulnerability CVE-2026-44492 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44494 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44494"
      },
      "action_statement": "Vulnerability CVE-2026-44494 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67312 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67312"
      },
      "action_statement": "Vulnerability CVE-2026-67312 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67313 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67313"
      },
      "action_statement": "Vulnerability CVE-2026-67313 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67314 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67314"
      },
      "action_statement": "Vulnerability CVE-2026-67314 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67315 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67315"
      },
      "action_statement": "Vulnerability CVE-2026-67315 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67317 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67317"
      },
      "action_statement": "Vulnerability CVE-2026-67317 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67318 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67318"
      },
      "action_statement": "Vulnerability CVE-2026-67318 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67320 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67320"
      },
      "action_statement": "Vulnerability CVE-2026-67320 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-30T11:26:33.324182+00:00",
      "status_notes": "Vulnerability CVE-2026-67321 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67321"
      },
      "action_statement": "Vulnerability CVE-2026-67321 affects version 1.16.0 of axios, and is fixed in 1.16.0-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-38gx-cfqf-f652"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-39j5-w47m-2gmv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-3mcp-22mf-vrw3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-42h9-826w-cgv3"
      },
      "action_statement": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-4ww2-rjh2-xpv9"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-68jp-44vc-2x5h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-6hqm-hm2v-3p2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-7q8q-rj6j-mhjq"
      },
      "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-9wx3-p993-35vp"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-f2r5-pqh9-r8f8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-f4gw-2p7v-4548 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-f4gw-2p7v-4548"
      },
      "action_statement": "Vulnerability GHSA-f4gw-2p7v-4548 affects version 1.16.0 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-fq2j-3j99-rx65"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.16.0.",
      "vulnerability": {
        "name": "GHSA-fqj3-h9pc-443h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-gcfj-64vw-6mp9 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-gcfj-64vw-6mp9"
      },
      "action_statement": "Vulnerability GHSA-gcfj-64vw-6mp9 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-hcpx-6fm6-wx23 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-hcpx-6fm6-wx23"
      },
      "action_statement": "Vulnerability GHSA-hcpx-6fm6-wx23 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-jqh4-m9w3-8hp9 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-jqh4-m9w3-8hp9"
      },
      "action_statement": "Vulnerability GHSA-jqh4-m9w3-8hp9 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-mmx7-hfxf-jppx"
      },
      "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mwf2-3pr3-8698 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-mwf2-3pr3-8698"
      },
      "action_statement": "Vulnerability GHSA-mwf2-3pr3-8698 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-pmv8-rq9r-6j72"
      },
      "action_statement": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.16.0 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.0",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.0"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-xj6q-8x83-jv6g affects version 1.16.0 of axios.",
      "vulnerability": {
        "name": "GHSA-xj6q-8x83-jv6g"
      },
      "action_statement": "Vulnerability GHSA-xj6q-8x83-jv6g affects version 1.16.0 of axios."
    }
  ]
}