{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3ebe0854-aa66-5f95-91bb-78a943172865", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@1.18.0", "type": "library", "bom-ref": "pkg:npm/axios@1.18.0", "version": "1.18.0", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:bc5a96e3-0146-50a0-a119-21254bd323e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 1.18.0 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:c554c1a4-412b-53d3-9f05-2559cd998d39", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-28168 does not affect version 1.18.0 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios 1.18.0-tuxcare.2. The vulnerability affected axios 0.21.0 where redirects did not preserve proxy configuration, allowing attackers to bypass proxy restrictions by serving redirects to internal hosts. The fix (installing a beforeRedirect callback that recursively applies proxy settings) was introduced in upstream axios co...", "justification": "code_not_present" } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:b43d0cfa-271b-5bb3-bd81-f30e0223568c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 1.18.0 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:150bc222-f193-5e43-a8cf-6b60cd64d16c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45857 does not affect version 1.18.0 of axios. not_affected \u2014 CVE-2023-45857 fix was already present in the upstream axios release that TuxCare onboarded for version 1.18.0. The vulnerable pattern (config.withCredentials || isURLSameOrigin) that allowed XSRF token leakage to cross-origin hosts was eliminated in upstream commit a3ff99b5 (April 2024) by robotshara@gmail.com, which moved XSRF handling to resolveConfig.js with the withXSRFToken option. The cu...", "justification": "code_not_present" } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:228b139d-89bf-57d5-9112-ef0256038f70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39338 affects version 1.18.0 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:5d848d07-d187-5b9e-9ced-817da1975f0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27152 affects version 1.18.0 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:ae25e54e-4f58-59c2-839c-2a3bb05cdcb3", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 1.18.0." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:37965b62-1479-5564-a2dd-301378326d28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 1.18.0 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:52c26de4-d8f2-56f0-9015-45980220125f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-62718 does not affect version 1.18.0 of axios. not_affected \u2014 CVE-2025-62718 (NO_PROXY hostname normalization bypass) is NOT present in axios 1.18.0-tuxcare.2. The fix was already included in the upstream v1.18.0 release that TuxCare onboarded. The shouldBypassProxy helper (lib/helpers/shouldBypassProxy.js) normalizes hostnames by stripping trailing dots and removing IPv6 brackets before NO_PROXY matching, preventing localhost. and [::1] from bypassing NO...", "justification": "code_not_present" } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:f1b99599-354f-516b-84cc-ffbe90ebee8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.1." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:20904540-59be-5677-8f8c-2a5ccb9ea394", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:7488c2aa-58db-5d55-bf87-f56c8d5dacce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:a9751acc-f4ee-5c81-aedd-92f028348b5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:e8153b21-fc8c-5375-ae5d-131ed57cebb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:2d63b9c2-2d42-5905-aa62-723e055e0d46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:1df8cf97-a0cf-5cdd-9b08-73c6493112a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:ebbb296b-dc96-5896-84a5-2cf07dfeb046", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:9bdc792a-43ee-5d5a-a163-91fdf15c2667", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:3af5a4b6-e247-5662-87df-2f6e87377b25", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:8c8cc75c-2dc2-5183-999f-e8dc3c4c7c3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:2530bba2-ddf1-5bc2-ba01-5bdcdb3fe081", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 1.18.0 of axios, and is fixed in 1.18.0-tuxcare.2." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:cf97fb52-26d4-587c-b424-e2bb4c336249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25639 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:ab3db7e3-b2c0-5ca9-b387-4cc2b8a23d3e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 1.18.0 of axios. not_affected \u2014 The target (axios v1.18.0) is not affected by CVE-2026-39865. The vulnerability was fixed in upstream v1.13.2 by commit 12c314b6 (author: robotshara@gmail.com), which restructured the Http2Sessions cleanup logic to return immediately after removing a session entry, preventing iteration over a modified array. Since v1.18.0 is newer than v1.13.2, the fix was already present in the upstream releas...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:308207e7-7a81-5b28-9926-47e38b77cc99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40175 does not affect version 1.18.0 of axios. not_affected \u2014 The target is NOT AFFECTED by CVE-2026-40175. The vulnerable pattern (unsanitized CRLF sequences in HTTP headers enabling request splitting) is not present because the target already includes comprehensive header sanitization that strips all CRLF characters. This defense was introduced by upstream commit cabead53 (author: r.salhab@aiyexpertsolutions.com) which shipped in the upstream release be...", "justification": "code_not_present" } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:7753413c-bcf7-5005-b991-8a6b95b35e02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42033 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:5e55f683-cba4-5c2c-b7b5-10bcd3669cc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42034 does not affect version 1.18.0 of axios. not_affected \u2014 CVE-2026-42034 is NOT present in axios 1.18.0. The vulnerability (maxBodyLength bypass for stream uploads when maxRedirects=0) was fixed in upstream commit 1c7f6d76 by jasonsaayman@gmail.com, which shipped in the axios 1.18.0 release before TuxCare onboarded it. The fix adds byte-counting Transform stream to enforce maxBodyLength on the native http/https transport path. Current code at lib/adap...", "justification": "code_not_present" } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:8ed9402e-f0c4-5607-9208-a940943e8571", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42035 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:efb66ed1-e001-575b-929a-34469e97666e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42036 does not affect version 1.18.0 of axios. not_affected \u2014 CVE-2026-42036 describes a vulnerability where Axios bypassed maxContentLength limits for streamed responses (responseType: 'stream'), allowing unbounded downstream consumption. The target repository at version 1.18.0-tuxcare.2 is NOT AFFECTED because the upstream fix (commit e8904af) shipped in the upstream release before TuxCare onboarding. The fix code is present at lib/adapters/http.js line...", "justification": "code_not_present" } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:930a4aa5-d9c6-51da-89b0-3d7fff6f2531", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 1.18.0 of axios. not_affected \u2014 The target (axios 1.18.0-tuxcare.2) is NOT AFFECTED by CVE-2026-42037. The vulnerable CRLF injection pattern in lib/helpers/formDataToStream.js was already fixed in the upstream release before TuxCare onboarded this version. The fix (commit 75873270) strips all \\r and \\n characters from value.type before interpolating it into the Content-Type header, preventing arbitrary header injection into m...", "justification": "code_not_present" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:6db78c36-d74a-5f2d-b548-a6d22d02f1cb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42038 does not affect version 1.18.0 of axios. not_affected \u2014 The target axios 1.18.0-tuxcare.2 is NOT AFFECTED by CVE-2026-42038. The loopback address equivalence fix is present at lib/helpers/shouldBypassProxy.js:381, where the function treats localhost, 127.0.0.1, and ::1 as equivalent when matching against no_proxy entries. This fix was authored by the upstream vendor (jasonsaayman@gmail.com) in commit 163da7226 and shipped in the upstream axios 1.18....", "justification": "code_not_present" } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:0ef3f75f-7250-57fa-b695-00af6a72da3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42039 does not affect version 1.18.0 of axios. not_affected \u2014 The target (axios 1.18.0-tuxcare.2) is NOT vulnerable to CVE-2026-42039. The upstream vendor (axios project) applied a complete fix in commit 85132ffb (authored by jasonsaayman@gmail.com) that shipped in the upstream 1.18.0 release, before TuxCare onboarded it. The fix adds depth tracking to toFormData's recursive build() function and throws a controlled AxiosError (ERR_FORM_DATA_DEPTH_EXCEEDED...", "justification": "code_not_present" } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:bc5e770f-6d16-50b9-b2a4-d1293593833e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 1.18.0 of axios. not_affected \u2014 The target axios version 1.18.0-tuxcare.2 is not affected by CVE-2026-42040 (null byte injection via reverse-encoding in AxiosURLSearchParams). The vulnerable code pattern - the charMap entry `'%00': '\\x00'` that decodes percent-encoded null bytes back to raw null bytes - was removed by upstream axios maintainer Jay (jasonsaayman@gmail.com) in commit 5266af94, released in axios v1.15.1 (April 2...", "justification": "code_not_present" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:0025d5af-a5b9-5568-a239-a534e6d10574", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42041 does not affect version 1.18.0 of axios. not_affected \u2014 Target axios 1.18.0-tuxcare.2 is NOT affected by CVE-2026-42041. The vulnerable code pattern (using the `in` operator in mergeDirectKeys function) is not present in this version. The upstream vendor fix (commit 42eb721e by Jay , dated April 19, 2026) replaced the vulnerable `in` operator with the safe `utils.hasOwnProp()` method. This fix was already included in the upst...", "justification": "code_not_present" } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:05e3647d-3021-562a-a19f-6b87839d0623", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 1.18.0 of axios. not_affected \u2014 CVE-2026-42042 describes a prototype pollution gadget in axios's XSRF token logic where truthy non-boolean values in `withXSRFToken` short-circuit the same-origin check, causing XSRF tokens to leak cross-origin. The target repository (axios v1.18.0-tuxcare.2) is NOT AFFECTED because the vulnerable code pattern was never present in this version. The fix (commit 1728aa1b by jasonsaayman@gmail.com...", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:5cfc2163-5bb9-5289-9061-7a294b8e931e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42043 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:569b276a-6c8c-5c10-9128-3b20b3308395", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 1.18.0 of axios. not_affected \u2014 The target repository (axios 1.18.0-tuxcare.2) is NOT affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerability was fixed in the upstream axios release via three defense layers applied in April 2026, before TuxCare onboarded this version. The vulnerable code pattern described in the CVE is not present in the target.", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:5c9dd87e-7e11-5a30-a486-9a01c0a13733", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:8ad8ad8a-663d-545e-bc37-8e9325e66f2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44486 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:2a3731cc-0f4d-5eab-a2d0-9e15915c81b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44487 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:d5ace2d7-ebf9-5387-b0e7-4b2743bc7a14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:f95f4988-b677-51e3-8a6f-dde7bb36f912", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44489 does not affect version 1.18.0 of axios. not_affected \u2014 The target (axios 1.18.0-tuxcare.2) is NOT affected by CVE-2026-44489. The vendor patch (commit 9d92bcd3) that fixes this prototype pollution vulnerability is already present in HEAD. The fix was authored by the upstream maintainer (jasonsaayman@gmail.com) and shipped in upstream v1.16.0, before TuxCare's first commit on this branch (e593d526). The vulnerable code pattern (direct proxy property...", "justification": "code_not_present" } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:f5d6b59f-6481-570f-b54f-2901d77b955d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44490 does not affect version 1.18.0 of axios. not_affected \u2014 Target axios 1.18.0-tuxcare.2 already contains the upstream fix for CVE-2026-44490 (commit 9d92bcd3, \"fix: gadgets and smaller issues (#10833)\"). It shipped in the upstream release TuxCare onboarded, so the verdict is not_affected. utils.merge now reads the accumulator only through own-property checks, and the mergeConfig defineProperty descriptor has a null prototype.", "justification": "code_not_present" } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:d543d819-3d98-5f89-a24e-fe2ca645d2ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44492 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:d70f2052-390c-529a-a8d0-a935d0a660f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:b66cbd5a-b3a6-5975-9af7-5252abad3bf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:1395102e-5a5b-5bbc-9824-f61a9b987601", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44496 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:18cb47db-c0ce-58d2-a01c-53a845ae3d6c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 1.18.0 of axios. not_affected \u2014 The target axios 1.18.0-tuxcare.2 is not affected by CVE-2026-67312 (uncontrolled recursion in formDataToJSON). The vulnerability pattern has been removed by upstream commit 32fc4896 authored by Jason Saayman, which introduced depth limits (MAX_DEPTH=100) with throwIfDepthExceeded() checks in both parsePropPath() and buildPath() functions. This fix was included in the upstream 1.18.0 release be...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:429a7ae4-986b-57a2-8e15-25ab931038ce", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 1.18.0 of axios. not_affected \u2014 The target (axios 1.18.0-tuxcare.2) already has the depth guard in formDataToJSON. It came in with the upstream commit 32fc4896 (jasonsaayman@gmail.com), which is inside the upstream release TuxCare onboarded. The unbounded-recursion pattern is not present.", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:9565e82f-c8ee-5aca-b9d0-1b0721a0c927", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67314 does not affect version 1.18.0 of axios. not_affected \u2014 Not affected. The Basic-auth subfield reads in all three adapters use utils.getSafeProp, which ignores values found only on a polluted Object.prototype. The fix is upstream commit 32fc4896, which is part of the upstream release TuxCare onboarded.", "justification": "code_not_present" } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:53fd9e48-83dc-5de9-94ae-1fe71eb7676a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67315 does not affect version 1.18.0 of axios. not_affected \u2014 axios 1.18.0 already contains the upstream fix. lib/helpers/shouldBypassProxy.js includes '0.0.0.0' in LOOPBACK_HOSTNAMES, so isLoopback('0.0.0.0') is true and NO_PROXY=localhost,127.0.0.1,::1 bypasses the proxy for http://0.0.0.0:/. The fix is upstream commit 32fc4896 (axios maintainer, via GitHub). It shipped in the upstream release that TuxCare onboarded, so it is not a TuxCare backport.", "justification": "code_not_present" } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:3bf45ba2-d098-5b17-97c9-c269c863d3a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67316 does not affect version 1.18.0 of axios. not_affected \u2014 All three prototype-pollution read gadgets (inherited data on bodyless aliases, proxy in the Node HTTP adapter, paramsSerializer in resolveConfig) are already guarded in HEAD. The guards come from upstream commit 32fc4896 (author jasonsaayman@gmail.com), which is part of the upstream 1.18.0 release before the first TuxCare commit.", "justification": "code_not_present" } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:cc6d19c4-c799-50d2-b47a-32768441639f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 1.18.0 of axios. not_affected \u2014 Target axios 1.18.0 already contains the upstream fix (commit 32fc4896, author jasonsaayman@gmail.com). The fetch adapter now wraps unknown-length ReadableStream/stream request bodies with a byte-counting trackStream and aborts with ERR_BAD_REQUEST once the count exceeds maxBodyLength. The fix shipped in the upstream release before the first TuxCare commit, so this is an upstream fix and not a ...", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:312c940a-0d0f-59c2-9115-8099cbe1142c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 1.18.0 of axios. not_affected \u2014 The target (axios 1.18.0) already contains the upstream fix 32fc4896. In lib/adapters/http.js the byte-counting stream wrapper applies on every transport except follow-redirects, which includes HTTP/2. The fix shipped in the upstream release, so the verdict is not_affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:b4123531-0eba-5eb4-aed1-98e9c4630847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67319 does not affect version 1.18.0 of axios. not_affected \u2014 Not affected. The upstream axios release that TuxCare onboarded (1.18.0) already contains the fix, commit 32fc489632 by jasonsaayman@gmail.com. Every sink named in the CVE reads nested option fields through utils.getSafeProp. That helper ignores anything that lives only on Object.prototype, so polluted username, password, encode or serialize values are never used.", "justification": "code_not_present" } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:7876b3e3-3f13-5f1a-b87e-b98bd1a87e34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 1.18.0 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:1463fb2c-9810-5b30-a134-8d646cc0fd58", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67321 does not affect version 1.18.0 of axios. not_affected \u2014 The upstream fix (axios 32fc4896) is already in this target. In lib/helpers/toFormData.js, the top-level '{}' key path now calls stringifyWithDepthLimit, which throws ERR_FORM_DATA_DEPTH_EXCEEDED before the nesting can overflow the stack. The commit predates the first TuxCare commit, so it shipped in the upstream release and the verdict is not_affected.", "justification": "code_not_present" } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:3426d6c8-7d1c-5efc-b4f4-6b05c77fda2d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.18.0." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:0f12475b-3961-5c5a-bd60-4a110403297d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.18.0." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:87bff26f-262f-5325-aa33-84b7f2b77cb2", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.18.0." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:77308b0b-2949-56ba-8a73-c42c061f4e78", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.18.0." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:831b72c1-a90e-5151-b139-7d3b69d49176", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.18.0." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:c9602248-e8ed-5432-b3e6-f6d538453ef9", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.18.0." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:54470ad7-edeb-5466-abbf-f5dcd6876fa5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.18.0." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:d8662b0b-3548-5cfd-bc24-f63634f92317", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.18.0." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:87558fca-ac06-56f7-8fc8-80ee24dfe065", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.18.0." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@1.18.0" } ], "bom-ref": "urn:uuid:26b97ffa-db46-5827-9f7c-6fb11d6ac014", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.18.0." } } ], "dependencies": [ { "ref": "pkg:npm/axios@1.18.0" } ] }