{
  "@id": "urn:uuid:774e1092-5d0c-4163-b2da-7f4596f84c63",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 28,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T11:41:35.274342+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2019-10742 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2019-10742"
      },
      "action_statement": "Vulnerability CVE-2019-10742 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T11:14:00.048324+00:00",
      "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.16.1 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios 1.16.1. The vulnerability affected Axios 0.21.0 where redirects did not preserve proxy settings, allowing attackers to bypass proxy restrictions. The upstream fix (commit c7329fef, Nov 2020) was already present in the upstream release 1.16.1 that TuxCare onboarded. The fix installs a beforeRedirect callback (lib/adapters...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28168"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios 1.16.1. The vulnerability affected Axios 0.21.0 where redirects did not preserve proxy settings, allowing attackers to bypass proxy restrictions. The upstream fix (commit c7329fef, Nov 2020) was already present in the upstream release 1.16.1 that TuxCare onboarded. The fix installs a beforeRedirect callback (lib/adapters..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2021-3749 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2021-3749"
      },
      "action_statement": "Vulnerability CVE-2021-3749 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T11:32:00.041551+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.16.1 of axios. not_affected \u2014 The target axios 1.16.1-tuxcare.3 is NOT vulnerable to CVE-2023-45857. The vulnerability (XSRF token leaked cross-origin when withCredentials=true) was fixed by upstream axios before version 1.16.1 was released. The fix commit (1728aa1b) introduced strict boolean validation that prevents the XSRF token from being sent cross-origin unless explicitly opted-in via withXSRFToken=true. The vulnerabl...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "impact_statement": "not_affected \u2014 The target axios 1.16.1-tuxcare.3 is NOT vulnerable to CVE-2023-45857. The vulnerability (XSRF token leaked cross-origin when withCredentials=true) was fixed by upstream axios before version 1.16.1 was released. The fix commit (1728aa1b) introduced strict boolean validation that prevents the XSRF token from being sent cross-origin unless explicitly opted-in via withXSRFToken=true. The vulnerabl..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2024-39338 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2024-39338"
      },
      "action_statement": "Vulnerability CVE-2024-39338 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "action_statement": "Vulnerability CVE-2025-27152 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "CVE-2025-54371"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-58754 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2025-58754"
      },
      "action_statement": "Vulnerability CVE-2025-58754 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T11:59:00.062955+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 does not affect version 1.16.1 of axios. not_affected \u2014 CVE-2025-62718 (NO_PROXY hostname normalization bypass) is not present in axios 1.16.1-tuxcare.3. The upstream vendor (axios) shipped the fix in version 1.16.1 before TuxCare onboarded this version. The fix commit fb3befb6 (authored by jasonsaayman@gmail.com) introduced shouldBypassProxy.js which normalizes hostnames by stripping IPv6 brackets and trailing dots before NO_PROXY comparison, preve...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "impact_statement": "not_affected \u2014 CVE-2025-62718 (NO_PROXY hostname normalization bypass) is not present in axios 1.16.1-tuxcare.3. The upstream vendor (axios) shipped the fix in version 1.16.1 before TuxCare onboarded this version. The fix commit fb3befb6 (authored by jasonsaayman@gmail.com) introduced shouldBypassProxy.js which normalizes hostnames by stripping IPv6 brackets and trailing dots before NO_PROXY comparison, preve..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:06:00.162437+00:00",
      "status_notes": "Vulnerability CVE-2026-101898 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101898"
      },
      "action_statement": "Vulnerability CVE-2026-101898 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:06:00.162437+00:00",
      "status_notes": "Vulnerability CVE-2026-101899 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101899"
      },
      "action_statement": "Vulnerability CVE-2026-101899 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:06:00.162437+00:00",
      "status_notes": "Vulnerability CVE-2026-101900 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101900"
      },
      "action_statement": "Vulnerability CVE-2026-101900 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:06:00.162437+00:00",
      "status_notes": "Vulnerability CVE-2026-101901 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101901"
      },
      "action_statement": "Vulnerability CVE-2026-101901 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:06:00.162437+00:00",
      "status_notes": "Vulnerability CVE-2026-101902 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101902"
      },
      "action_statement": "Vulnerability CVE-2026-101902 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:06:00.162437+00:00",
      "status_notes": "Vulnerability CVE-2026-101903 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101903"
      },
      "action_statement": "Vulnerability CVE-2026-101903 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-19T22:06:00.162437+00:00",
      "status_notes": "Vulnerability CVE-2026-101904 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-101904"
      },
      "action_statement": "Vulnerability CVE-2026-101904 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:28.980217+00:00",
      "status_notes": "Vulnerability CVE-2026-101905 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101905"
      },
      "action_statement": "Vulnerability CVE-2026-101905 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:28.980217+00:00",
      "status_notes": "Vulnerability CVE-2026-101906 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101906"
      },
      "action_statement": "Vulnerability CVE-2026-101906 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101907 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101907"
      },
      "action_statement": "Vulnerability CVE-2026-101907 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:28.980217+00:00",
      "status_notes": "Vulnerability CVE-2026-101908 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101908"
      },
      "action_statement": "Vulnerability CVE-2026-101908 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-27T11:08:28.980217+00:00",
      "status_notes": "Vulnerability CVE-2026-101909 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-101909"
      },
      "action_statement": "Vulnerability CVE-2026-101909 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "action_statement": "Vulnerability CVE-2026-25639 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T11:50:00.749941+00:00",
      "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.16.1 of axios. not_affected \u2014 Target is NOT AFFECTED. The vulnerability (CVE-2026-39865) describes an HTTP/2 session cleanup bug where iteration continues over an array after splice() modifies it, causing crashes. The fix commit 12c314b6 (authored by Dmitriy Mozgovoy upstream on 2025-11-04) is present on HEAD and was already shipped in the upstream axios 1.16.1 release before TuxCare onboarded this version. The target code ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39865"
      },
      "impact_statement": "not_affected \u2014 Target is NOT AFFECTED. The vulnerability (CVE-2026-39865) describes an HTTP/2 session cleanup bug where iteration continues over an array after splice() modifies it, causing crashes. The fix commit 12c314b6 (authored by Dmitriy Mozgovoy upstream on 2025-11-04) is present on HEAD and was already shipped in the upstream axios 1.16.1 release before TuxCare onboarded this version. The target code ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:06:00.906699+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 does not affect version 1.16.1 of axios. not_affected \u2014 The target axios 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-40175. The upstream fix for this CRLF header injection vulnerability was already present in the axios 1.16.1 release that TuxCare onboarded. The fix commit (363185461b90b1b78845dc8a99a1f103d9b122a1, authored by jasonsaayman@gmail.com on 2026-04-06) predates the first TuxCare commit on this branch. The defense sanitizes all header val...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "impact_statement": "not_affected \u2014 The target axios 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-40175. The upstream fix for this CRLF header injection vulnerability was already present in the axios 1.16.1 release that TuxCare onboarded. The fix commit (363185461b90b1b78845dc8a99a1f103d9b122a1, authored by jasonsaayman@gmail.com on 2026-04-06) predates the first TuxCare commit on this branch. The defense sanitizes all header val..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "action_statement": "Vulnerability CVE-2026-42033 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:19:00.089013+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.16.1 of axios. not_affected \u2014 CVE-2026-42034 (maxBodyLength bypass for streamed uploads when maxRedirects=0) is not present in axios 1.16.1-tuxcare.3. The fix was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern (direct data.pipe(req) without byte counting) has been replaced by enforcement logic at lib/adapters/http.js:1346-1381 that wraps streamed uploads with a Transform stream ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42034 (maxBodyLength bypass for streamed uploads when maxRedirects=0) is not present in axios 1.16.1-tuxcare.3. The fix was already included in the upstream release that TuxCare onboarded. The vulnerable code pattern (direct data.pipe(req) without byte counting) has been replaced by enforcement logic at lib/adapters/http.js:1346-1381 that wraps streamed uploads with a Transform stream ..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "action_statement": "Vulnerability CVE-2026-42035 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:37:58.643486+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.16.1 of axios. not_affected \u2014 CVE-2026-42036 describes a vulnerability where Axios bypasses maxContentLength enforcement when responseType: 'stream' is used, allowing unbounded response consumption. The target (axios 1.16.1-tuxcare.3) is NOT AFFECTED because it already contains the upstream fix (commit e8904af) that was shipped in upstream release v1.16.1. The fix wraps streamed responses in a size-counting generator that e...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42036 describes a vulnerability where Axios bypasses maxContentLength enforcement when responseType: 'stream' is used, allowing unbounded response consumption. The target (axios 1.16.1-tuxcare.3) is NOT AFFECTED because it already contains the upstream fix (commit e8904af) that was shipped in upstream release v1.16.1. The fix wraps streamed responses in a size-counting generator that e..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:15:15.720335+00:00",
      "status_notes": "Vulnerability CVE-2026-42037 does not affect version 1.16.1 of axios. not_affected \u2014 CVE-2026-42037 describes a CRLF injection vulnerability in axios FormData multipart body construction where value.type is interpolated unsanitized into Content-Type headers. The target repository (axios 1.16.1-tuxcare.3 at SHA e71540d9) contains the fix at lib/helpers/formDataToStream.js:27 that sanitizes value.type by removing all CR/LF characters before header interpolation. This fix was auth...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42037"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42037 describes a CRLF injection vulnerability in axios FormData multipart body construction where value.type is interpolated unsanitized into Content-Type headers. The target repository (axios 1.16.1-tuxcare.3 at SHA e71540d9) contains the fix at lib/helpers/formDataToStream.js:27 that sanitizes value.type by removing all CR/LF characters before header interpolation. This fix was auth..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:29:00.234144+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.16.1 of axios. not_affected \u2014 CVE-2026-42038 is NOT present in the target. The vulnerability (incomplete fix for no_proxy loopback alias bypass) was fixed by upstream commit 163da7226fd2cd21f0f238f99b2f75a51bf9b2a3, which shipped in the upstream release before TuxCare's work began. The fix adds loopback address equivalence checking: when matching URL hostnames against no_proxy entries, localhost, 127.0.0.1, and ::1 are now ...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42038 is NOT present in the target. The vulnerability (incomplete fix for no_proxy loopback alias bypass) was fixed by upstream commit 163da7226fd2cd21f0f238f99b2f75a51bf9b2a3, which shipped in the upstream release before TuxCare's work began. The fix adds loopback address equivalence checking: when matching URL hostnames against no_proxy entries, localhost, 127.0.0.1, and ::1 are now ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:23:00.154087+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.16.1 of axios. not_affected \u2014 CVE-2026-42039 (unbounded recursion in toFormData leading to stack overflow) is NOT present in axios 1.16.1-tuxcare.3. The fix (depth limiting via throwIfMaxDepthExceeded) was already shipped in upstream axios 1.16.1 before TuxCare onboarded this version. The vulnerable code pattern (recursive build() without depth checks) does not exist in the target; the defense code (maxDepth=100 default, ER...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-42039 (unbounded recursion in toFormData leading to stack overflow) is NOT present in axios 1.16.1-tuxcare.3. The fix (depth limiting via throwIfMaxDepthExceeded) was already shipped in upstream axios 1.16.1 before TuxCare onboarded this version. The vulnerable code pattern (recursive build() without depth checks) does not exist in the target; the defense code (maxDepth=100 default, ER..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:50:04.472788+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 does not affect version 1.16.1 of axios. not_affected \u2014 The target axios version 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-42040 (null byte injection via reverse-encoding in AxiosURLSearchParams). The vulnerable code pattern - the charMap entry '%00': '\\x00' that reverses safe percent-encoding - is not present in the codebase. The upstream vendor (axios maintainer jasonsaayman@gmail.com) applied the fix in commit 5266af94 on April 16, 2026, remov...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "impact_statement": "not_affected \u2014 The target axios version 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-42040 (null byte injection via reverse-encoding in AxiosURLSearchParams). The vulnerable code pattern - the charMap entry '%00': '\\x00' that reverses safe percent-encoding - is not present in the codebase. The upstream vendor (axios maintainer jasonsaayman@gmail.com) applied the fix in commit 5266af94 on April 16, 2026, remov..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:40:05.418341+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.16.1 of axios. not_affected \u2014 The target axios 1.16.1-tuxcare.3 is not affected by CVE-2026-42041. The vulnerable code pattern (using the `in` operator in `mergeDirectKeys` function) is not present. The upstream vendor (axios) already fixed this vulnerability in commit 42eb721e before the TuxCare 1.16.1 branch was created. The fix replaces `prop in config2` and `prop in config1` with `utils.hasOwnProp(config2, prop)` and `u...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "impact_statement": "not_affected \u2014 The target axios 1.16.1-tuxcare.3 is not affected by CVE-2026-42041. The vulnerable code pattern (using the `in` operator in `mergeDirectKeys` function) is not present. The upstream vendor (axios) already fixed this vulnerability in commit 42eb721e before the TuxCare 1.16.1 branch was created. The fix replaces `prop in config2` and `prop in config1` with `utils.hasOwnProp(config2, prop)` and `u..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:51:46.244247+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.16.1 of axios. not_affected \u2014 Target axios 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-42042. The vulnerability (prototype pollution allowing XSRF token leakage via truthy non-boolean values) was fixed in upstream axios commit 1728aa1b (authored by jasonsaayman@gmail.com), which shipped in the upstream 1.16.1 release. TuxCare onboarded this already-fixed release. The target code at lib/helpers/resolveConfig.js:97-98 uses s...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "impact_statement": "not_affected \u2014 Target axios 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-42042. The vulnerability (prototype pollution allowing XSRF token leakage via truthy non-boolean values) was fixed in upstream axios commit 1728aa1b (authored by jasonsaayman@gmail.com), which shipped in the upstream 1.16.1 release. TuxCare onboarded this already-fixed release. The target code at lib/helpers/resolveConfig.js:97-98 uses s..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "action_statement": "Vulnerability CVE-2026-42043 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:08:39.118992+00:00",
      "status_notes": "Vulnerability CVE-2026-42044 does not affect version 1.16.1 of axios. not_affected \u2014 The target axios 1.16.1-tuxcare.3 is NOT affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable pattern\u2014direct access to `this.parseReviver` without hasOwnProperty validation\u2014is not present in the target. Two defensive layers are active: (1) the `own()` helper in lib/defaults/index.js:129 checks `hasOwnProp` before accessing parseReviver, returning undefined if not...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42044"
      },
      "impact_statement": "not_affected \u2014 The target axios 1.16.1-tuxcare.3 is NOT affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable pattern\u2014direct access to `this.parseReviver` without hasOwnProperty validation\u2014is not present in the target. Two defensive layers are active: (1) the `own()` helper in lib/defaults/index.js:129 checks `hasOwnProp` before accessing parseReviver, returning undefined if not..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-42264 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42264"
      },
      "action_statement": "Vulnerability CVE-2026-42264 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44488 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44488"
      },
      "action_statement": "Vulnerability CVE-2026-44488 affects version 1.16.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-04T12:51:46.244247+00:00",
      "status_notes": "Vulnerability CVE-2026-44489 does not affect version 1.16.1 of axios. not_affected \u2014 Target axios 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-44489. The upstream fix (commit 9d92bcd3) was already present in the axios 1.16.1 release that TuxCare onboarded. The fix adds hasOwnProperty checks in lib/utils.js merge() and lib/adapters/http.js setProxy() to prevent reading inherited prototype properties that could inject attacker-controlled Proxy-Authorization headers. Both defensiv...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44489"
      },
      "impact_statement": "not_affected \u2014 Target axios 1.16.1-tuxcare.3 is NOT AFFECTED by CVE-2026-44489. The upstream fix (commit 9d92bcd3) was already present in the axios 1.16.1 release that TuxCare onboarded. The fix adds hasOwnProperty checks in lib/utils.js merge() and lib/adapters/http.js setProxy() to prevent reading inherited prototype properties that could inject attacker-controlled Proxy-Authorization headers. Both defensiv..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-06T11:41:35.274342+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 does not affect version 1.16.1 of axios. not_affected \u2014 The target (axios 1.16.1-tuxcare.3) already contains the upstream fix for CVE-2026-44490. Upstream commit 9d92bcd3 (\"fix: gadgets and smaller issues (#10833)\", author jasonsaayman@gmail.com) is in the upstream 1.16.1 release, before the first TuxCare commit. utils.merge now reads accumulator slots only through own-property checks, and the defineProperty descriptors are null-prototype. Header in...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44490"
      },
      "impact_statement": "not_affected \u2014 The target (axios 1.16.1-tuxcare.3) already contains the upstream fix for CVE-2026-44490. Upstream commit 9d92bcd3 (\"fix: gadgets and smaller issues (#10833)\", author jasonsaayman@gmail.com) is in the upstream 1.16.1 release, before the first TuxCare commit. utils.merge now reads accumulator slots only through own-property checks, and the defineProperty descriptors are null-prototype. Header in..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "action_statement": "Vulnerability CVE-2026-44492 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44494 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44494"
      },
      "action_statement": "Vulnerability CVE-2026-44494 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 1.16.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67312 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67312"
      },
      "action_statement": "Vulnerability CVE-2026-67312 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67313 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67313"
      },
      "action_statement": "Vulnerability CVE-2026-67313 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:08:00.083788+00:00",
      "status_notes": "Vulnerability CVE-2026-67314 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67314"
      },
      "action_statement": "Vulnerability CVE-2026-67314 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67315 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67315"
      },
      "action_statement": "Vulnerability CVE-2026-67315 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:08:00.083788+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67317 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67317"
      },
      "action_statement": "Vulnerability CVE-2026-67317 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67318 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67318"
      },
      "action_statement": "Vulnerability CVE-2026-67318 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67320 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67320"
      },
      "action_statement": "Vulnerability CVE-2026-67320 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-20T06:09:00.084146+00:00",
      "status_notes": "Vulnerability CVE-2026-67321 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-67321"
      },
      "action_statement": "Vulnerability CVE-2026-67321 affects version 1.16.1 of axios, and is fixed in 1.16.1-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-38gx-cfqf-f652"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-39j5-w47m-2gmv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-3mcp-22mf-vrw3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-4ww2-rjh2-xpv9"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-68jp-44vc-2x5h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-6hqm-hm2v-3p2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-9wx3-p993-35vp"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-f2r5-pqh9-r8f8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-fq2j-3j99-rx65"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-10-26T14:00:26.903551+00:00",
      "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.16.1.",
      "vulnerability": {
        "name": "GHSA-fqj3-h9pc-443h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.16.1",
          "identifiers": {
            "purl": "pkg:npm/axios@1.16.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-hcpx-6fm6-wx23 affects version 1.16.1 of axios.",
      "vulnerability": {
        "name": "GHSA-hcpx-6fm6-wx23"
      },
      "action_statement": "Vulnerability GHSA-hcpx-6fm6-wx23 affects version 1.16.1 of axios."
    }
  ]
}