{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:03db4188-4a4c-56b9-b9ae-611723ef21db", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@1.6.2-tuxcare.6", "type": "library", "bom-ref": "pkg:npm/axios@1.6.2-tuxcare.6", "version": "1.6.2-tuxcare.6", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@1.6.2", "type": "library", "version": "1.6.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:19dc769f-ed1f-5d1a-91ed-188bd12ec667", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7a918211-2854-5d13-9eb6-15edef4d1a79", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-28168 does not affect version 1.6.2-tuxcare.6 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios 1.6.2-tuxcare.6. The upstream vendor fix (commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto) was already included in the release that TuxCare onboarded. The fix adds a beforeRedirects.proxy callback in lib/adapters/http.js:161-165 that re-applies proxy configuration to all HTTP redirects, preventing dire...", "justification": "code_not_present" } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:85b404b6-9072-5d6d-8a8f-f3563c2d37d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1d5b85aa-ccf2-5513-89e0-b87ecd9978c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45857 does not affect version 1.6.2-tuxcare.6 of axios. not_affected \u2014 CVE-2023-45857 vulnerability is NOT PRESENT in axios 1.6.2-tuxcare.6. The vulnerable pattern that leaked XSRF tokens to cross-origin hosts when withCredentials was enabled has been removed by upstream commit 96ee232b (Oct 26, 2023), which shipped in the upstream 1.6.2 release. The fix was authored by Valentin Panov (not a TuxCare engineer) and was already present when TuxCare onboarded this ver...", "justification": "code_not_present" } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:c2ff0de3-3d30-55f3-afc5-fc4d0a392012", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-39338 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2024-39338 fix already exists in commit 057ad74c0909265dd1d8ff30efeec60c4ae86f82", "justification": "code_not_present" } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7534deb7-3ee7-5faa-85a5-c539debafcde", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-27152 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2025-27152 fix already exists in commit ed2d6c5ecb396f8852feef6fcbe4e56c7249e816", "justification": "code_not_present" } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f8960a88-916a-53a6-aa2f-3e8d05eeae9f", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:376723b1-248f-58f8-bd98-86ba5427b95f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58754 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:291b3542-0789-5477-bdc8-af289bf0df1f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-62718 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2025-62718 fix already exists in commit f9dc1665d64e97f3f3c31cd7d39c641b7440b3be", "justification": "code_not_present" } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:10e9f9af-fd16-58e7-be02-85fe410b2334", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:a6e971ea-1428-5dfc-95cd-982e0ec9070d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:3f850a79-df28-58ea-9d9f-61e835efa401", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:0484a2bf-a6ef-52b2-b72b-455c78c55440", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f3c6ea03-143f-531d-a0ae-2e44774b64cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101902 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:781563c0-315e-577d-8976-4623e9ebfaf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:0f7e1268-bdc2-5fb7-9c82-b070b476a3e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101904 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:caa6cb06-1481-554e-a4a5-1846a8dc54b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:bf38563f-ac79-5e5b-9b89-d9001dbc6859", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7be4e484-34ca-58e0-9ee4-ad0af91c88d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:cddda5cc-fa40-5739-9b97-95ce8b633a0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ba69075a-bb33-5d32-96f2-448f53f7ba17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:854e9f59-29e1-5f67-ab04-bd742ffb6baa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25639 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-25639 fix already exists in commit 5503387c150a939f3e07e8f2ddbe9b1ce94736c0", "justification": "code_not_present" } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f4a76c94-4bda-52b6-86a5-7704e51f7718", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 1.6.2-tuxcare.6 of axios. not_affected \u2014 Target version 1.6.2-tuxcare.6 does not contain HTTP/2 support. The vulnerable Http2Sessions cleanup code exists only in later versions (commit d676df77 and beyond, including the fix in commit 12c314b6), none of which are ancestors of the current HEAD. Exhaustive searches confirm zero HTTP/2 code in the target's lib/adapters/http.js (856 lines, only HTTP/1.1 support via http/https modules). Thi...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:90d0a1b6-701d-529d-a26f-e587dd768f46", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-40175 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-40175 fix already exists in commit 71a6807ba8d80dd444f41f70cc9705737c09a3a5", "justification": "code_not_present" } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:2ee2d128-e5da-523c-a44d-6c9fec20982d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42033 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-42033 fix already exists in commit d375fe2f8a1ef7722292c14e20a4ef028daef004", "justification": "code_not_present" } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7e37aaf4-32f7-519d-b8ce-0cb6ef19c17a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1b6c3cc7-fe96-5d98-9bb1-6b318c756a37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5d975674-5ff6-55f0-8b51-89593e7d0190", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42036 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-42036 fix already exists in commit e0368ff92ab3a4acc7f6b10d7c6c0de6c3039fcd", "justification": "code_not_present" } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:d4083a98-6b8c-501b-b872-985711ae315e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42037 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:6d0dc440-3fb3-5869-ac52-c495e1a6a97a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42038 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-42038 fix already exists in commit be3bb2c6810c347ce441607c58460d2c262544f7", "justification": "code_not_present" } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1a154047-8409-5ce7-991f-717671c6d98b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42039 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-42039 fix already exists in commit 62486025c75bc40992b91377bdd75a56c063f7db", "justification": "code_not_present" } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f0660304-140f-51f4-855d-5c79f71cad64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:9cf03f6c-af74-5758-b729-ab6fdf63a096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:52b15d72-165e-5842-840d-233e98138914", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-42042 fix already exists in commit aa7d9c8f621ddd33f123c8728bce3578b16ce4d5", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:44a0a122-8a0b-507f-b384-fb6e1652a76c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42043 does not affect version 1.6.2-tuxcare.6 of axios. CVE-2026-42043 fix already exists in commit eabe9b190df42964e9e83d6a6964cc5f998651aa", "justification": "code_not_present" } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:eb0d57b2-6249-577c-8b0f-2ed208ebcf8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42044 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:2ca4b090-3fcf-549c-8d74-87c210bdf99d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42264 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:402c7925-a899-5ca5-91ff-890db0076f22", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:79a3dc43-7d73-5b40-9468-b5271e8a94c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:fe6180ad-9431-5122-877e-4d35c75dd323", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:a3f569d8-bcaf-5a46-af70-b5a467c5b28b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44489 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:77b8be3c-0700-527f-a7e0-200d0fed28e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:bd4c72f9-a283-5894-9d39-75986bbcea53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44492 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:1c69be68-d53b-55d2-b8fb-e1545cbeab9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44494 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:37283e16-d9e5-5426-9584-69f20271b567", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:e30027e6-5007-5576-b806-2e954e7ec97d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:9a15fa54-2539-5975-af8e-927c3c6afc39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67312 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:4071757b-4731-53c4-9170-9c656c01087f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67313 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:2c7f0b84-d04e-5c8f-8c86-5d1548e007e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:9988e403-e8bf-5e50-98c2-f5a4375d6ef5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:5ca4e039-3096-51d5-9d38-9d2eb6bdf78b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:340c5858-54b5-5476-89ae-697b183163fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 1.6.2-tuxcare.6 of axios. not_affected \u2014 Target is axios 1.6.2-tuxcare.6. It has no fetch adapter (lib/adapters contains only http.js, xhr.js, adapters.js; default adapter is ['xhr','http']), so the flaw (unbounded unknown-length WHATWG ReadableStream request bodies via the fetch adapter) cannot occur. The http adapter caps streamed uploads, and a bare WHATWG ReadableStream is rejected there.", "justification": "code_not_present" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f0c8fae5-91c7-5ac1-9a5b-54c6e32400d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 1.6.2-tuxcare.6 of axios. not_affected \u2014 axios 1.6.2 (tuxcare.6) has no HTTP/2 support: there is no httpVersion option, http2 transport or isHttp2 branch in lib/. The CVE's vulnerable path (HTTP/2 transport that ignores maxBodyLength and skips the byte-counting wrapper) does not exist here. The only transports are http/https (maxRedirects===0, wrapped by the byte counter) and follow-redirects (enforces maxBodyLength).", "justification": "code_not_present" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:a8617b5e-8c29-5299-92ec-86c24cd7bb14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:e8b278f0-4dfe-5f68-8b42-1e9cb47d9886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7286b008-9481-5e26-99ab-9d2a33b22d59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67321 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:95912e09-c010-5706-855a-2aeba493bf0b", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:2d367a05-04dc-5540-9083-1c3d8849c463", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:566fe69b-112d-518b-980f-d4153ac3fc90", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-42h9-826w-cgv3", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:69d0871a-acc4-552d-b61d-f7f99fa754e5", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:c64a9fd8-3f14-5bce-9593-30e0f8b7b856", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:15061e9c-0ae4-5443-8ba3-632e9c623bbb", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f9f4f106-0e48-5a42-9833-d53d72180c5c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:f672bc7c-7d89-5c10-8ea8-6274b6da06c0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.6.2-tuxcare.6 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:339e087e-87b5-53d5-ae99-3b74ada3b0f5", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:467f0696-5fa9-5cea-aa10-273007bb905c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:78a2ae96-f195-564c-8751-4dccbce94cbb", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:ea9893dc-9357-533d-9274-f9eda9b8a876", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.6.2-tuxcare.6." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:e5b85252-273f-5082-b346-e29a56b10be3", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx is fixed in version 1.6.2-tuxcare.6 of axios." } }, { "id": "GHSA-pmv8-rq9r-6j72", "affects": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ], "bom-ref": "urn:uuid:7d85db3f-81f4-53b4-ac48-42f723c7e9b2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.6.2-tuxcare.6 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@1.6.2-tuxcare.6" } ] }