{ "@id": "urn:uuid:539776d7-71ab-4bd3-9662-7525db6005e9", "role": "Document Creator", "author": "https://tuxcare.com", "version": 28, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:37:00.067378+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T11:22:42.437181+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.20.0 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios v1.20.0. The vulnerability was fixed in upstream commit c7329fefc890050edd51e40e469a154d0117fc55, which shipped in v0.21.1 (November 2020). The target version 1.20.0 (released 2025) includes this fix. The vulnerable pattern (proxy settings not re-applied on HTTP redirects) has been absent since v0.21.1. The fix is confir...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios v1.20.0. The vulnerability was fixed in upstream commit c7329fefc890050edd51e40e469a154d0117fc55, which shipped in v0.21.1 (November 2020). The target version 1.20.0 (released 2025) includes this fix. The vulnerable pattern (proxy settings not re-applied on HTTP redirects) has been absent since v0.21.1. The fix is confir..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T11:38:52.435560+00:00", "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.20.0 of axios. not_affected \u2014 Target version 1.20.0 is NOT affected by CVE-2023-45857. The vulnerable pattern (sending XSRF-TOKEN to cross-origin hosts when withCredentials is enabled) does not exist. The code implements the withXSRFToken option with strict same-origin validation by default, preventing cross-origin token leakage. The fix was shipped in upstream axios release 1.20.0 and was not authored by TuxCare/CloudLinux.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45857" }, "impact_statement": "not_affected \u2014 Target version 1.20.0 is NOT affected by CVE-2023-45857. The vulnerable pattern (sending XSRF-TOKEN to cross-origin hosts when withCredentials is enabled) does not exist. The code implements the withXSRFToken option with strict same-origin validation by default, preventing cross-origin token leakage. The fix was shipped in upstream axios release 1.20.0 and was not authored by TuxCare/CloudLinux." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.20.0.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:02:05.366668+00:00", "status_notes": "Vulnerability CVE-2025-62718 does not affect version 1.20.0 of axios. not_affected \u2014 The target axios v1.20.0 is NOT AFFECTED by CVE-2025-62718. The vulnerability (NO_PROXY bypass via hostname normalization issues with trailing dots and IPv6 brackets) was fixed in upstream axios v1.15.0 via commit fb3befb6. Since the target version v1.20.0 is newer than v1.15.0, the fix was already present in the upstream release that TuxCare onboarded. The fix includes the shouldBypassProxy he...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62718" }, "impact_statement": "not_affected \u2014 The target axios v1.20.0 is NOT AFFECTED by CVE-2025-62718. The vulnerability (NO_PROXY bypass via hostname normalization issues with trailing dots and IPv6 brackets) was fixed in upstream axios v1.15.0 via commit fb3befb6. Since the target version v1.20.0 is newer than v1.15.0, the fix was already present in the upstream release that TuxCare onboarded. The fix includes the shouldBypassProxy he..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:02:05.366668+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.20.0 of axios. not_affected \u2014 The target (axios 1.20.0) is not affected by CVE-2026-39865. The vulnerability was fixed in upstream axios v1.13.2 (November 2025) by commit 12c314b6, authored by upstream contributor Dmitriy Mozgovoy (robotshara@gmail.com). The fix restructured the HTTP/2 session cleanup logic to prevent continued iteration over a modified array by adding an unconditional return statement. The fixed code is pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 The target (axios 1.20.0) is not affected by CVE-2026-39865. The vulnerability was fixed in upstream axios v1.13.2 (November 2025) by commit 12c314b6, authored by upstream contributor Dmitriy Mozgovoy (robotshara@gmail.com). The fix restructured the HTTP/2 session cleanup logic to prevent continued iteration over a modified array by adding an unconditional return statement. The fixed code is pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:04:33.242318+00:00", "status_notes": "Vulnerability CVE-2026-40175 does not affect version 1.20.0 of axios. not_affected \u2014 The target axios v1.20.0 is NOT AFFECTED by CVE-2026-40175. The vulnerability (CRLF injection via unsanitized headers) was fixed in upstream commit cabead53 (2026-05-06) which introduced lib/helpers/sanitizeHeaderValue.js. This fix strips control characters including CR (\\r, \\u000d) and LF (\\n, \\u000a) from header values using regex [\\u0000-\\u0008\\u000a-\\u001f\\u007f]+. The fix was included in u...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40175" }, "impact_statement": "not_affected \u2014 The target axios v1.20.0 is NOT AFFECTED by CVE-2026-40175. The vulnerability (CRLF injection via unsanitized headers) was fixed in upstream commit cabead53 (2026-05-06) which introduced lib/helpers/sanitizeHeaderValue.js. This fix strips control characters including CR (\\r, \\u000d) and LF (\\n, \\u000a) from header values using regex [\\u0000-\\u0008\\u000a-\\u001f\\u007f]+. The fix was included in u..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:23:00.154087+00:00", "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.20.0 of axios. not_affected \u2014 CVE-2026-42034 is NOT present in axios v1.20.0. The upstream vendor fixed this vulnerability in commit 1c7f6d76e (author: Jason Saayman, 2026-04-18) which was included in the upstream axios 1.20.0 release before TuxCare onboarded it. The fix adds byte-counting enforcement for streamed uploads when using native http/https transport (maxRedirects === 0), preventing oversized request bodies from b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42034" }, "impact_statement": "not_affected \u2014 CVE-2026-42034 is NOT present in axios v1.20.0. The upstream vendor fixed this vulnerability in commit 1c7f6d76e (author: Jason Saayman, 2026-04-18) which was included in the upstream axios 1.20.0 release before TuxCare onboarded it. The fix adds byte-counting enforcement for streamed uploads when using native http/https transport (maxRedirects === 0), preventing oversized request bodies from b..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:42:44.637840+00:00", "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.20.0 of axios. not_affected \u2014 CVE-2026-42036 is NOT PRESENT in axios v1.20.0. The vulnerability (missing maxContentLength enforcement on responseType: 'stream') was fixed in upstream commit e8904af0 by maintainer Jay (jasonsaayman@gmail.com) and shipped in upstream release v1.15.1. The current version (v1.20.0) contains the complete fix at lib/adapters/http.js:1232-1256, which wraps the response stream in an async generator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42036" }, "impact_statement": "not_affected \u2014 CVE-2026-42036 is NOT PRESENT in axios v1.20.0. The vulnerability (missing maxContentLength enforcement on responseType: 'stream') was fixed in upstream commit e8904af0 by maintainer Jay (jasonsaayman@gmail.com) and shipped in upstream release v1.15.1. The current version (v1.20.0) contains the complete fix at lib/adapters/http.js:1232-1256, which wraps the response stream in an async generator..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:20:22.883132+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 1.20.0 of axios. not_affected \u2014 Target axios v1.20.0 is NOT AFFECTED by CVE-2026-42037 (CRLF injection in FormData multipart handling). The vulnerable code pattern is not present because the upstream fix (commit 75873270, shipped in v1.15.1+) already sanitizes value.type to strip CRLF sequences before interpolating into Content-Type headers. The fix at lib/helpers/formDataToStream.js:27 applies `.replace(/[\\r\\n]/g, '')` to pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 Target axios v1.20.0 is NOT AFFECTED by CVE-2026-42037 (CRLF injection in FormData multipart handling). The vulnerable code pattern is not present because the upstream fix (commit 75873270, shipped in v1.15.1+) already sanitizes value.type to strip CRLF sequences before interpolating into Content-Type headers. The fix at lib/helpers/formDataToStream.js:27 applies `.replace(/[\\r\\n]/g, '')` to pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:32:36.937135+00:00", "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.20.0 of axios. not_affected \u2014 Axios version 1.20.0 is NOT affected by CVE-2026-42038. The vulnerability (no_proxy loopback alias bypass) was fixed in upstream commit 163da722 by Jay (jasonsaayman@gmail.com), which is an ancestor of HEAD. The target contains this upstream fix plus subsequent enhancements providing comprehensive loopback equivalence checking. Runtime tests confirm all CVE test cases pass: no_proxy=localhost b...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42038" }, "impact_statement": "not_affected \u2014 Axios version 1.20.0 is NOT affected by CVE-2026-42038. The vulnerability (no_proxy loopback alias bypass) was fixed in upstream commit 163da722 by Jay (jasonsaayman@gmail.com), which is an ancestor of HEAD. The target contains this upstream fix plus subsequent enhancements providing comprehensive loopback equivalence checking. Runtime tests confirm all CVE test cases pass: no_proxy=localhost b..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:31:00.046915+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.20.0 of axios. not_affected \u2014 The target (axios 1.20.0) is not affected by CVE-2026-42039. The vulnerability\u2014unbounded recursion in toFormData causing call stack exhaustion\u2014was fixed by upstream commit 85132ffb (\"fix: form data recursion (#10726)\" by Jay , Apr 15 2026). The fix adds a configurable depth limit (default 100) and throws AxiosError with code ERR_FORM_DATA_DEPTH_EXCEEDED when exceeded, pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 The target (axios 1.20.0) is not affected by CVE-2026-42039. The vulnerability\u2014unbounded recursion in toFormData causing call stack exhaustion\u2014was fixed by upstream commit 85132ffb (\"fix: form data recursion (#10726)\" by Jay , Apr 15 2026). The fix adds a configurable depth limit (default 100) and throws AxiosError with code ERR_FORM_DATA_DEPTH_EXCEEDED when exceeded, pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:48:00.044418+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 1.20.0 of axios. not_affected \u2014 CVE-2026-42040 is not present in axios v1.20.0. The vulnerable code pattern (charMap entry '%00': '\\x00' that reverses safe percent-encoding of null bytes) was removed by upstream commit 5266af94 (authored by Jay ) on April 16, 2026, shipping in v1.15.1. The target version (1.20.0) already contains this upstream fix. The current code at lib/helpers/AxiosURLSearchParams.j...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 CVE-2026-42040 is not present in axios v1.20.0. The vulnerable code pattern (charMap entry '%00': '\\x00' that reverses safe percent-encoding of null bytes) was removed by upstream commit 5266af94 (authored by Jay ) on April 16, 2026, shipping in v1.15.1. The target version (1.20.0) already contains this upstream fix. The current code at lib/helpers/AxiosURLSearchParams.j..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:46:00.112754+00:00", "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.20.0 of axios. not_affected \u2014 CVE-2026-42041 (Prototype Pollution gadget in validateStatus merge) is NOT present in axios v1.20.0. The vulnerable pattern (using JavaScript's `in` operator in mergeDirectKeys function, which traverses the prototype chain) was fixed in upstream axios v1.15.1 via commit 42eb721e by jasonsaayman@gmail.com. The fix replaced `if (prop in config2)` and `if (prop in config1)` with `if (utils.hasOwnP...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42041" }, "impact_statement": "not_affected \u2014 CVE-2026-42041 (Prototype Pollution gadget in validateStatus merge) is NOT present in axios v1.20.0. The vulnerable pattern (using JavaScript's `in` operator in mergeDirectKeys function, which traverses the prototype chain) was fixed in upstream axios v1.15.1 via commit 42eb721e by jasonsaayman@gmail.com. The fix replaced `if (prop in config2)` and `if (prop in config1)` with `if (utils.hasOwnP..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:50:04.472788+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.20.0 of axios. not_affected \u2014 The target axios version 1.20.0 is NOT affected by CVE-2026-42042. The vulnerability (truthy coercion in withXSRFToken allowing cross-origin XSRF token leakage) was fixed in upstream commit 1728aa1b by author Jay (jasonsaayman@gmail.com) on 2026-04-19, which shipped in the upstream 1.20.0 release before TuxCare onboarded this version. The fix replaced the vulnerable truthy check with strict boo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 The target axios version 1.20.0 is NOT affected by CVE-2026-42042. The vulnerability (truthy coercion in withXSRFToken allowing cross-origin XSRF token leakage) was fixed in upstream commit 1728aa1b by author Jay (jasonsaayman@gmail.com) on 2026-04-19, which shipped in the upstream 1.20.0 release before TuxCare onboarded this version. The fix replaced the vulnerable truthy check with strict boo..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:15:15.720335+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 1.20.0 of axios. not_affected \u2014 The target repository (axios v1.20.0) is not affected by CVE-2026-42044. The vulnerability was fixed in the upstream release via commit 70302b6c, which prevents prototype-polluted Object.prototype.parseReviver from being inherited. The fix uses hasOwnProp checks (via the `own()` helper) before reading config.parseReviver, ensuring that only explicitly-set parseReviver functions are used. This i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 The target repository (axios v1.20.0) is not affected by CVE-2026-42044. The vulnerability was fixed in the upstream release via commit 70302b6c, which prevents prototype-polluted Object.prototype.parseReviver from being inherited. The fix uses hasOwnProp checks (via the `own()` helper) before reading config.parseReviver, ensuring that only explicitly-set parseReviver functions are used. This i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-04T12:56:00.045936+00:00", "status_notes": "Vulnerability CVE-2026-44489 does not affect version 1.20.0 of axios. not_affected \u2014 The target axios v1.20.0 is NOT AFFECTED by CVE-2026-44489. The vulnerability pattern (unguarded proxy property reads allowing prototype pollution to inject Proxy-Authorization headers) is absent from the target code. The vendor fix (commit 9d92bcd, authored by jasonsaayman@gmail.com on 2026-05-02) was already included in the upstream release v1.20.0 (2026-08-19) before TuxCare onboarded it (20...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44489" }, "impact_statement": "not_affected \u2014 The target axios v1.20.0 is NOT AFFECTED by CVE-2026-44489. The vulnerability pattern (unguarded proxy property reads allowing prototype pollution to inject Proxy-Authorization headers) is absent from the target code. The vendor fix (commit 9d92bcd, authored by jasonsaayman@gmail.com on 2026-05-02) was already included in the upstream release v1.20.0 (2026-08-19) before TuxCare onboarded it (20..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T11:44:06.729260+00:00", "status_notes": "Vulnerability CVE-2026-44490 does not affect version 1.20.0 of axios. not_affected \u2014 axios 1.20.0 already contains the fixes for both read-side prototype-pollution gadgets. utils.merge() reads the accumulator through an own-property check, and all defineProperty descriptors, including the one in mergeConfig, are null-prototype. The fix shipped in the upstream release, in commit 9d92bcd3 by jasonsaayman@gmail.com. HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44490" }, "impact_statement": "not_affected \u2014 axios 1.20.0 already contains the fixes for both read-side prototype-pollution gadgets. utils.merge() reads the accumulator through an own-property check, and all defineProperty descriptors, including the one in mergeConfig, are null-prototype. The fix shipped in the upstream release, in commit 9d92bcd3 by jasonsaayman@gmail.com. HEAD has no TuxCare-domain commits." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 1.20.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T22:44:00.074903+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 1.20.0 of axios. not_affected \u2014 axios 1.20.0 is NOT affected by CVE-2026-67312. The vulnerability (uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket-delimited segments) was fixed by upstream commit 32fc489 (author: jasonsaayman@gmail.com). This fix was already present in the upstream release 1.20.0 before TuxCare onboarded it. The target contains the complete defense: thr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 axios 1.20.0 is NOT affected by CVE-2026-67312. The vulnerability (uncontrolled recursion in formDataToJSON when processing FormData field names with deeply nested bracket-delimited segments) was fixed by upstream commit 32fc489 (author: jasonsaayman@gmail.com). This fix was already present in the upstream release 1.20.0 before TuxCare onboarded it. The target contains the complete defense: thr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T21:16:00.038769+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 1.20.0 of axios. not_affected \u2014 axios 1.20.0 already contains the depth guard for formDataToJSON (CVE-2026-67313). The guard was added by upstream commit 32fc4896 (author jasonsaayman@gmail.com), which is an ancestor of HEAD. The repo's only TuxCare-side commit is a tuxcare.yaml build-config commit. The vulnerable unbounded-recursion pattern is not present.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 axios 1.20.0 already contains the depth guard for formDataToJSON (CVE-2026-67313). The guard was added by upstream commit 32fc4896 (author jasonsaayman@gmail.com), which is an ancestor of HEAD. The repo's only TuxCare-side commit is a tuxcare.yaml build-config commit. The vulnerable unbounded-recursion pattern is not present." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T21:12:49.807216+00:00", "status_notes": "Vulnerability CVE-2026-67314 does not affect version 1.20.0 of axios. not_affected \u2014 Target axios 1.20.0 already contains the upstream fix (commit 32fc489, jasonsaayman@gmail.com). All three Basic-auth read sites (http.js, fetch.js, resolveConfig.js) use utils.getSafeProp, which ignores values reachable only through a polluted Object.prototype. The fix was shipped in the upstream release before the first TuxCare commit, so the verdict is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67314" }, "impact_statement": "not_affected \u2014 Target axios 1.20.0 already contains the upstream fix (commit 32fc489, jasonsaayman@gmail.com). All three Basic-auth read sites (http.js, fetch.js, resolveConfig.js) use utils.getSafeProp, which ignores values reachable only through a polluted Object.prototype. The fix was shipped in the upstream release before the first TuxCare commit, so the verdict is not_affected, not already_fixed." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T21:29:00.126347+00:00", "status_notes": "Vulnerability CVE-2026-67315 does not affect version 1.20.0 of axios. not_affected \u2014 Axios 1.20.0 already treats 0.0.0.0 as local when matching NO_PROXY. lib/helpers/shouldBypassProxy.js:1 has LOOPBACK_HOSTNAMES = new Set(['localhost', '0.0.0.0']), and isIPv6Unspecified() also covers '::'. The fix is upstream commit 32fc4896, which is an ancestor of HEAD. Its author is jasonsaayman@gmail.com and its committer is noreply@github.com, neither in a TuxCare domain. HEAD has no TuxCa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67315" }, "impact_statement": "not_affected \u2014 Axios 1.20.0 already treats 0.0.0.0 as local when matching NO_PROXY. lib/helpers/shouldBypassProxy.js:1 has LOOPBACK_HOSTNAMES = new Set(['localhost', '0.0.0.0']), and isIPv6Unspecified() also covers '::'. The fix is upstream commit 32fc4896, which is an ancestor of HEAD. Its author is jasonsaayman@gmail.com and its committer is noreply@github.com, neither in a TuxCare domain. HEAD has no TuxCa..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T12:40:25.004786+00:00", "status_notes": "Vulnerability CVE-2026-67316 does not affect version 1.20.0 of axios. not_affected \u2014 The target (axios 1.20.0) already contains the upstream fix for all three gadgets. Bodyless aliases read data only if it is an own property. The Node HTTP adapter reads proxy through getSafeProp. resolveConfig and the adapter read paramsSerializer through own-property accessors. Upstream commit 32fc4896 (jasonsaayman@gmail.com) is in HEAD, and HEAD has no TuxCare-authored commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67316" }, "impact_statement": "not_affected \u2014 The target (axios 1.20.0) already contains the upstream fix for all three gadgets. Bodyless aliases read data only if it is an own property. The Node HTTP adapter reads proxy through getSafeProp. resolveConfig and the adapter read paramsSerializer through own-property accessors. Upstream commit 32fc4896 (jasonsaayman@gmail.com) is in HEAD, and HEAD has no TuxCare-authored commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T21:21:52.067188+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 1.20.0 of axios. not_affected \u2014 The fetch adapter in axios 1.20.0 already enforces maxBodyLength on unknown-length ReadableStream and Node stream request bodies. The fix is upstream commit 32fc4896, which is an ancestor of HEAD and was authored by a non-TuxCare author. HEAD's history has no TuxCare-domain commits, so this is an upstream fix shipped in the release and the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 The fetch adapter in axios 1.20.0 already enforces maxBodyLength on unknown-length ReadableStream and Node stream request bodies. The fix is upstream commit 32fc4896, which is an ancestor of HEAD and was authored by a non-TuxCare author. HEAD's history has no TuxCare-domain commits, so this is an upstream fix shipped in the release and the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T21:26:00.054149+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 1.20.0 of axios. not_affected \u2014 Target axios 1.20.0 already contains the upstream fix. The byte-counting maxBodyLength wrapper for streamed uploads now applies to every transport except follow-redirects, including HTTP/2. The fix shipped in the upstream release (commit 32fc4896, author jasonsaayman@gmail.com), with no TuxCare involvement.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 Target axios 1.20.0 already contains the upstream fix. The byte-counting maxBodyLength wrapper for streamed uploads now applies to every transport except follow-redirects, including HTTP/2. The fix shipped in the upstream release (commit 32fc4896, author jasonsaayman@gmail.com), with no TuxCare involvement." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T12:48:16.462979+00:00", "status_notes": "Vulnerability CVE-2026-67319 does not affect version 1.20.0 of axios. not_affected \u2014 Axios 1.20.0 already contains the upstream fix. Every consumer of nested auth and paramsSerializer reads fields through utils.getSafeProp, which ignores values that exist only on a polluted Object.prototype. The PoC (auth: {}, paramsSerializer: {} with a polluted Object.prototype) therefore cannot inject an Authorization header or replace the query string. The fix shipped in the upstream releas...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67319" }, "impact_statement": "not_affected \u2014 Axios 1.20.0 already contains the upstream fix. Every consumer of nested auth and paramsSerializer reads fields through utils.getSafeProp, which ignores values that exist only on a polluted Object.prototype. The PoC (auth: {}, paramsSerializer: {} with a polluted Object.prototype) therefore cannot inject an Authorization header or replace the query string. The fix shipped in the upstream releas..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 1.20.0 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 1.20.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-06T21:37:00.067378+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 1.20.0 of axios. not_affected \u2014 Axios 1.20.0 already contains the upstream fix for CVE-2026-67321. In lib/helpers/toFormData.js, defaultVisitor no longer calls bare JSON.stringify for top-level keys ending in \"{}\". It calls stringifyWithDepthLimit, which throws AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED from a JSON.stringify replacer once nesting passes maxDepth. The fix commit 32fc4896 is by the upstream maintainer and is in th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Axios 1.20.0 already contains the upstream fix for CVE-2026-67321. In lib/helpers/toFormData.js, defaultVisitor no longer calls bare JSON.stringify for top-level keys ending in \"{}\". It calls stringifyWithDepthLimit, which throws AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED from a JSON.stringify replacer once nesting passes maxDepth. The fix commit 32fc4896 is by the upstream maintainer and is in th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.20.0", "identifiers": { "purl": "pkg:npm/axios@1.20.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.20.0.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." } ] }