{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ec40634d-49d7-51f7-b43a-47496eb0b5b1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.21.4-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/axios@0.21.4-tuxcare.6", "version": "0.21.4-tuxcare.6", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@0.21.4", "type": "library", "version": "0.21.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:16543358-1359-5faf-b0b5-fa9722867fd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:663ba7a6-719b-5aca-a2e5-e8a20b2d886b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-28168 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios 0.21.4-tuxcare.6. The vulnerability allowed attackers to bypass configured proxies by providing URLs that redirect to restricted hosts. The fix was already present in the upstream release that TuxCare onboarded. The defense is implemented via a `beforeRedirect` callback in the `setProxy` function (lib/adapters/http.js:13...", "justification": "code_not_present" } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:516b68c9-cfc0-5d04-90be-2c80f0619ae8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:68c87fd2-fd48-5846-9cb7-583262cceecc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:82e88f77-9d9d-56a6-8d1a-e540ddcd178b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-39338 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 The target repository (axios 0.21.4-tuxcare.1) is not affected by CVE-2024-39338. While the upstream vulnerability exists in axios 1.7.2 which uses the modern WHATWG URL API (new URL()), version 0.21.4 uses the legacy Node.js url.parse() API. This architectural difference prevents the SSRF exploitation: url.parse() treats protocol-relative URLs (starting with '//') as pathnames with null hostna...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ccefe598-445a-5c7a-a92d-8694ca575075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a20aaee2-400a-5715-8441-6c97524265cb", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:9c8db7e7-8e99-5dd8-b2fe-70084b468b72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:556c7caf-5232-5fc6-9106-ef661b76fc06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5affbaf1-2922-5e11-8114-408743735583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:4da04993-9350-5a83-89da-403b0fdef9fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ee1fc045-de3d-5f93-9116-9b5bbcea646a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:7961ea66-230b-57f2-9727-57a8f5e233c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:885ac7cd-3b77-5d13-b022-5ceaf06dfb05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3c671b62-3a24-532f-8702-0dcf7a78868b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:4b2c2e83-9497-5204-9bfd-f72c602f2eac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5fb829a7-53a6-5be2-b795-5d7a30e1e0de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a63fd0f2-7648-5f34-a653-5233a790ed8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:404815ee-d7fe-5f42-826e-23acbde54fb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:24c4e809-28a6-5a2f-aeb9-579c12ec598d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:c64f7379-2497-598a-ada9-77515c2db78c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:79ec28ad-cbf5-5152-84bf-7f82676c128c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3f8a6e01-ef5e-5cc2-83a1-c311694d551c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 Target version axios 0.21.4 does not have HTTP/2 support and therefore cannot be affected by CVE-2026-39865. The vulnerability exists in the Http2Sessions class's session cleanup logic (array iteration bug after splice), which was introduced in axios versions much later than 0.21.4. Exhaustive search confirms zero HTTP/2 code, no http2 module imports, no Http2Sessions class, and no session mana...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a117b889-a2bd-5a1d-aa43-a833793bb652", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:562d4f39-f519-52ae-83d4-4a9c58645ea4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:de2dd28e-709f-5a65-a919-e21cb926c12d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:f4748018-4f66-5b44-8c67-dabedfed5095", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:d95c337e-6b58-50eb-be39-c2256b92521b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:59dad561-5af9-5a6e-811d-570ada693547", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 axios 0.21.4 is not affected by CVE-2026-42037. The vulnerability exists in lib/helpers/formDataToStream.js, which constructs multipart form-data bodies and interpolates value.type into Content-Type headers without CRLF sanitization. This file does not exist in axios 0.21.4 (released Sept 2021) and was introduced in the 1.x series (post-2022). In version 0.21.4, FormData objects are passed thro...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:0a55824d-b423-5d4a-812b-75b794ded097", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:568fe45a-3d1e-5958-8460-e7d667948405", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ac686010-d040-5525-a931-aea9a2681cd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:b36d70ca-c3e4-5888-b4a8-db66a48a8b32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a00259eb-3929-5219-bf29-ceebe8651397", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a3d1a2e3-d17f-5678-9c34-a1ec538b83c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42043 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:467f797c-0167-5b08-a935-96755fccd90f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 Version 0.21.4 is not affected by CVE-2026-42044 because the parseReviver feature does not exist in this version. The vulnerability requires JSON.parse to be called with a second parameter (this.parseReviver) that can inherit from Object.prototype.parseReviver. However, the transformResponse function at lib/defaults.js:89 calls JSON.parse(data) with NO second parameter. The parseReviver feature...", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ac1a2bcd-6146-500c-852a-8324333e7c2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:89bd6dd8-9190-5e95-89f9-779a95d0cc7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:c5a453a7-a54b-5c51-9e61-d163f1c3402d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3c21ce86-7f74-5dcb-94c3-59685534e7d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:87ada5bd-eae5-578d-b2b0-f820eda9eb14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44489 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:bec7df65-ca06-578f-b49f-4dc1f8969558", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:f500c293-93e6-5c39-991b-10a02ee14723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44492 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1d69b8d2-6a4e-516f-ae64-f59740fc4549", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5c00de92-e717-5d8f-8077-3163d81893cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44495 does not affect version 0.21.4-tuxcare.6 of axios. already_fixed \u2014 The target repository (axios 0.21.4-tuxcare.1) already contains the fix for CVE-2026-44495. The vulnerability was addressed in a prior TuxCare backport under CVE-2026-42033 (commit cb446abd, July 1, 2026), which implements the same hasOwnProperty guards as the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1a13f8f4-1fab-5fbe-abc2-5f637e900017", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3f6eaa6a-150b-5201-9eb5-9702dc1a13e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 axios 0.21.4 is NOT affected by CVE-2026-67312. The vulnerable formDataToJSON functionality (which parses FormData field names with bracket-delimited segments and can cause call stack exhaustion via unbounded recursion) does not exist in this version. The formDataToJSON feature was introduced in axios v0.28.0 (commit c008e57f, 2022-05-25), while the target version 0.21.4 predates this by severa...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:cb8748de-523d-5b1d-a269-2146276f14ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 Not affected. The target is axios 0.21.4-tuxcare.6, which predates the FormData-to-JSON helper (introduced in 0.28.0). There is no formDataToJSON.js, no formToJSON export and no recursive path-building code. In this version FormData is passed through the default transformRequest unchanged.", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:fcffb1e4-9ff8-5077-92ac-f747a077ca26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:b491f89f-8642-57ff-929d-05bd59a35480", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5ce498a3-e6bd-54e2-b356-544108f660b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:11f99fd8-8a29-525f-8029-65b79e88ab7f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 axios 0.21.4-tuxcare.6 has no fetch adapter. It ships only the http and xhr adapters, and the flawed code in lib/adapters/fetch.js does not exist. The http adapter already caps streamed uploads at maxBodyLength.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:f7ecfb8e-410d-529a-b49b-7c3dc8be21c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 Target is axios 0.21.4 (TuxCare branch), which has no HTTP/2 transport or httpVersion option. The CVE bypass needs the HTTP/2 transport, which neither follow-redirects nor the native byte counter covers. In this target, streamed bodies go through follow-redirects or a native transport, and a byte-counting limiter covers the native one. The limit is enforced on every path. I could not fetch the ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:10a42066-b392-54a5-86bc-88fa6a937b34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:728e67f1-6dfb-5da7-b9ef-b97cf7b29eaf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:42eb522c-26a2-5f1f-82f5-ed3e3b96a09b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 0.21.4-tuxcare.6 of axios. not_affected \u2014 The target is axios 0.21.4-tuxcare.6. It has no lib/helpers/toFormData.js, no form or urlencoded serializer, no '{}' metatoken handling and no maxDepth guard. The upstream fix only changes toFormData.js, which does not exist here, so the bypass described in the CVE cannot occur. One caveat: buildURL and the default JSON request transform call JSON.stringify directly on caller-supplied objects. ...", "justification": "code_not_present" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:210fc632-b2b5-5d48-ad73-459c328951f0", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1b1a8be7-0945-564c-b824-d56388bd1c78", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:d9bc9a3d-b5fb-542d-87d4-3031380378e4", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:6c3aa329-a788-540e-87a4-f17dc458d17f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:f0008c5f-74ba-5a61-8e54-00671b7e0c5d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:9281759a-4817-54a3-941f-3db65235e61d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:c912e5e2-1ef4-5f21-868a-408fc7282fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.21.4-tuxcare.6 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:33bffd41-d4ca-58b0-a322-648e05339cbf", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:02f4741f-1720-583d-9d34-8516df220248", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5ac1e2f6-02d7-5705-9e76-77039524ec3c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:c64908ad-252c-5a96-be1c-be9f7ad10c12", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.21.4-tuxcare.6." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ], "bom-ref": "urn:uuid:0ff4c3f7-920e-5876-8e5c-4879e80e70bc", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.21.4-tuxcare.6 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.21.4-tuxcare.6" } ] }