{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:ac30a809-c095-5935-a14f-58e8ea8af0e6",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "axios",
      "purl": "pkg:npm/axios@1.7.7-tuxcare.7",
      "type": "library",
      "bom-ref": "pkg:npm/axios@1.7.7-tuxcare.7",
      "version": "1.7.7-tuxcare.7",
      "pedigree": {
        "ancestors": [
          {
            "name": "axios",
            "purl": "pkg:npm/axios@1.7.7",
            "type": "library",
            "version": "1.7.7"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10742",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e64ab1bf-2e12-5af3-8657-d4d8b58563bc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10742 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2020-28168",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b496e161-a7b4-5b2b-b35b-2dbfae09a17f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2020-28168 does not affect version 1.7.7-tuxcare.7 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirects) is not present in axios 1.7.7-tuxcare.8. The vulnerability was fixed in upstream commit c7329fef by Daniel Lopretto, which shipped in the upstream release before TuxCare onboarding (first TuxCare commit 8866c1fb). The fix adds a beforeRedirect callback that re-applies proxy configuration to redirect requests, preventing direct connections to r...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2021-3749",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:feb95727-484c-5a9c-9be1-2fc7a6c59450",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3749 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2023-45857",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8e56b0b1-dcfc-5375-b8c6-51c052ce3d32",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2023-45857 does not affect version 1.7.7-tuxcare.7 of axios. not_affected \u2014 CVE-2023-45857 is NOT present in axios 1.7.7-tuxcare.8. The vulnerability, which allowed XSRF tokens to leak to cross-origin hosts when withCredentials was set, was fixed in the upstream v1.7.7 release before TuxCare onboarding. The current code in lib/helpers/resolveConfig.js (lines 50-64) only sends XSRF tokens when withXSRFToken===true (explicit opt-in) or when withXSRFToken==null AND isURLS...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-39338",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:61ac79d5-f7a5-5a3e-955a-b99f774fabcc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-39338 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2025-27152",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6b1a6c0e-0d77-5782-9467-21385d771ccf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-27152 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2025-54371",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:92b29d7d-9ae3-5894-bb2b-a1328bef48bc",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "CVE-2025-58754",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e1054b56-969d-5fd9-831a-67c5de7a9ed8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-58754 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2025-62718",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:df693f9b-2a28-5b67-86f8-57f1d389e3e9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-62718 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101898",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c57ea0ad-bcd8-5ae1-bb27-a126a9eb0b81",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101898 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101899",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:98c70b92-fb56-5558-8d35-f7e70ad32598",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101899 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101900",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d953a503-18e5-56db-bc45-812ea2502ef1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101900 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101901",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e1a4552f-6934-55e7-a10d-4b650f49e351",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101901 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101902",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b53ed8ee-5675-53ae-b573-544712c7c742",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101902 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101903",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:197667f1-1025-51e6-92d0-b4336002cfc6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101903 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101904",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:854a1463-e2a7-54cf-8739-71d82eea96cc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-101904 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101905",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ff4ae648-554a-5355-bb84-1ce64b7963d8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101905 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101906",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:68c2307d-8793-55a5-8697-853a0b054327",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101906 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101907",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a146a1c6-2456-576c-b157-c026ca664cec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101907 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-101908",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:85fd5850-0f2c-5d52-a757-0f1fff4f93c7",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-101908 does not affect version 1.7.7-tuxcare.7 of axios. not_affected \u2014 Target version 1.7.7-tuxcare.1 is NOT AFFECTED by CVE-2026-101908. The vulnerable code pattern (passing fetchOptions as the second argument to fetch()) does not exist in this version. The target code at lib/adapters/fetch.js:272 calls `fetch(request)` with no second argument, preventing inherited prototype-polluted properties from overriding the Request's safe headers. The vulnerability was int...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-101909",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:417822ba-1b31-55b4-9a59-bad3bab6adb3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101909 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-25639",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8ff2a108-eecd-5a14-81de-20aad1daaa68",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25639 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-39865",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:14c0c696-7b03-5219-ba0b-07b18c2ef247",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-39865 does not affect version 1.7.7-tuxcare.7 of axios. not_affected \u2014 CVE-2026-39865 does not affect axios v1.7.7 because HTTP/2 support and the vulnerable Http2Sessions class do not exist in this version. HTTP/2 support was introduced in v1.13.0 (commit d676df77), which is 6 minor versions after v1.7.7. The vulnerable session cleanup code in Http2Sessions.getSession() that allows array iteration after modification via splice() was never present in v1.7.7, as the...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-40175",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5857551e-1909-52d6-84c9-46ab11ed50ef",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-40175 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42033",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:05a081ab-9f87-5715-bc48-0e55e9da613d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42033 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42034",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:08bef710-e117-5e22-8153-1ba5998b241e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42034 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42035",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d896e6d4-47d0-52b2-9e24-6e4f2e1ad160",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42035 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42036",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:36a786e5-7205-5992-b2ca-222da3f4e98b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42036 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42037",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:1945bd3e-d519-50d5-9eb2-f8b90a1d2bb3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42037 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42038",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:35a44f02-11e5-5fc7-85b2-feb79f86ffea",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42038 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42039",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ddccf913-d60e-5c32-8a82-de50ad07e2ab",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42039 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42040",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2e44c211-d3a2-53ed-a1fd-b9846fd85973",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42040 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42041",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:57832abe-10f9-56db-90dd-8e2e977a67c1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42041 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42042",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:39b6a9d2-b063-584a-a209-35f17eeeb888",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42042 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42043",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7f09d040-a1dc-5f8a-b403-ba8410ef5e2f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42043 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42044",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fc8e7596-4178-55db-81f3-62f34d7a4ec2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42044 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-42264",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ae9d41db-f87b-55ff-9d2d-2f236c31b69b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-42264 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44486",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:7b53304b-29ee-5573-b256-be90ebd34471",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44486 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44487",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:c000de55-20b3-57b0-a558-ad5a470c7d4e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44487 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44488",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:080dd8f8-6550-568f-9da7-e94da7f14204",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44488 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44489",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f4b3df9a-bceb-5cd8-b22c-4fa300a51ceb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44489 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44490",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:4de8c060-02cf-5ac6-978d-ef8bf9fe410c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44490 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44492",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:71474502-6d6b-5782-8f77-d919a17f7ec2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44492 affects version 1.7.7-tuxcare.7 of axios, and is fixed in 1.7.7-tuxcare.8."
      }
    },
    {
      "id": "CVE-2026-44494",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:d49c3773-1d3d-521c-934f-08ffe24c5b2b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44494 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44495",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ff3c3f06-76d0-543e-91b0-1f11884130f9",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44495 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-44496",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:644b3a59-62cd-5e23-9590-7b26f22d226c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44496 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67312",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:2dfedcb0-6bef-5a79-b3cb-1eb9b6c99619",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67312 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67313",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:85cf136a-5d07-5bee-8e36-492e10eca5cf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67313 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67314",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:19a40c17-535f-523e-a41c-f9a6087a4d61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67314 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67315",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e9c1b998-a6a7-5e12-9417-0abb4d5952a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67315 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67316",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fa1a6a50-86b8-5e06-838d-5edc0f47ca5c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67316 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67317",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:398340f8-e187-5fa4-bd2e-9539d56c6c9a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67317 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67318",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:b069d45d-337d-52e5-b3c2-609c29688117",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-67318 does not affect version 1.7.7-tuxcare.7 of axios. not_affected \u2014 axios 1.7.7 (tuxcare.8) has no HTTP/2 support, so the CVE's bypass path does not exist. The only transports are native http/https and follow-redirects. Streamed uploads are limited on both: follow-redirects enforces options.maxBodyLength, and the byte-counting wrapper in lib/adapters/http.js covers the maxRedirects===0 native path.",
        "justification": "protected_at_runtime"
      }
    },
    {
      "id": "CVE-2026-67319",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:5d0b0f1a-b69d-56bf-9c5a-1f89d69ef473",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-67319 is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67320",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:81c085bb-565e-511a-b7ea-18a5c231be03",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67320 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "CVE-2026-67321",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:e1b32a3b-c230-5667-bb2d-43d30087c321",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67321 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "GHSA-38gx-cfqf-f652",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:f5ea6b73-35cb-5f57-95a6-f83524fce23e",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-39j5-w47m-2gmv",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0c8e0304-530d-5e1b-bb09-6c77353d068a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-3mcp-22mf-vrw3",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:dfaa2099-3cbb-5cfc-b2e4-636e2b8750a2",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-42h9-826w-cgv3",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:45d4a590-72e7-56e1-8f02-a12a74a64b27",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "GHSA-4ww2-rjh2-xpv9",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:a8f99c17-7825-5025-b40c-dc03b27de887",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-68jp-44vc-2x5h",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:de627840-a9c8-5359-a8da-235bb89779d6",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-6hqm-hm2v-3p2p",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:34d1e7ad-39ad-560b-aeb6-2665d433bff7",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-7q8q-rj6j-mhjq",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:46bb058a-9fdc-5bf2-8341-04dc89f6b67a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "GHSA-9wx3-p993-35vp",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:ae7ab32a-7db9-56e7-9bef-d8decc645b93",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-f2r5-pqh9-r8f8",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:0f7c8318-7b3c-5f13-bc77-b5289b6245bb",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-fq2j-3j99-rx65",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:fb282a6b-3687-5ab5-9b29-a9fd5f9135d3",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-fqj3-h9pc-443h",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:19132c06-1d13-5f11-9d21-dbd44a45fdcf",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.7.7-tuxcare.7."
      }
    },
    {
      "id": "GHSA-jqh4-m9w3-8hp9",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:26d57f11-c41d-5f54-aa81-b7892ea5002e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-jqh4-m9w3-8hp9 affects version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "GHSA-mmx7-hfxf-jppx",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:8f28fa48-e275-5e2b-8922-2a5ab53a04a1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability GHSA-mmx7-hfxf-jppx is fixed in version 1.7.7-tuxcare.7 of axios."
      }
    },
    {
      "id": "GHSA-pmv8-rq9r-6j72",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
        }
      ],
      "bom-ref": "urn:uuid:6bc61723-7201-5da1-9c3c-d81ce1ce19ba",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.7.7-tuxcare.7 of axios."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@1.7.7-tuxcare.7"
    }
  ]
}