{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a23ed319-59f5-5d79-991c-602875781912", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@1.7.9-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/axios@1.7.9-tuxcare.5", "version": "1.7.9-tuxcare.5", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@1.7.9", "type": "library", "version": "1.7.9" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:e8b9c163-cbba-5e2b-9e3b-95152aa6e903", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:1d22df35-6013-58a0-bfe7-fd112b815b83", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-28168 does not affect version 1.7.9-tuxcare.5 of axios. not_affected \u2014 Target version 1.7.9-tuxcare.5 is not affected by CVE-2020-28168 (SSRF via proxy bypass on redirect). The upstream vendor fix (commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto, committed Nov 24, 2020) shipped in the upstream release that TuxCare onboarded. The fix installs a beforeRedirects.proxy callback that re-applies proxy configuration to each redirect hop, preventing att...", "justification": "code_not_present" } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:c651b51e-dbd7-57b1-a061-6d87404d26d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:197e2bed-7f09-5bd6-be22-78d649df7590", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-45857 does not affect version 1.7.9-tuxcare.5 of axios. not_affected \u2014 CVE-2023-45857 does not affect axios 1.7.9. The vulnerability (XSRF token leakage to cross-origin hosts when withCredentials=true) was fixed in upstream commit 96ee232b (Oct 2023), which shipped in the upstream release before TuxCare onboarded version 1.7.9. The target contains the secure implementation using withXSRFToken option with strict same-origin checks by default, preventing cross-origi...", "justification": "code_not_present" } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:a0df0388-da7b-56f4-b17c-f191c0c44616", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-39338 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:1d942c89-b52a-5b26-a0d4-666ade2ac817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:dff80b3f-a56f-5e18-aa01-4ce5e41f4306", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:305c1dcb-d8b0-5613-93e1-bb5ee6fd2201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58754 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:3508c560-013a-5c20-8551-60b1afd1e389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:a7f24254-f09a-5d46-91d3-e4d977a2ad1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:c764cae4-2a75-5467-a27f-b0291ab7043f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:b64bf415-b148-55b0-b91c-0276a439a786", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:e7464740-b241-5b09-8083-a5dc291fcd0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:703450f3-0839-5c26-b445-49623c50dc0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101902 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:f7bcfe63-1cb4-5a66-9122-b18bfd0728d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:9bec084c-7616-50cf-93af-0468d46a1f04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101904 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:543dbe08-7dff-5ce0-881b-1d4e4f0c16ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:4b8d19d2-a24e-5e34-8840-add7cad1ffe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:2efe6c64-4cd8-59d9-ae0d-a36d323c7def", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:34fba65f-52c0-5b04-b5fa-45d69616f815", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101908 does not affect version 1.7.9-tuxcare.5 of axios. not_affected \u2014 CVE-2026-101908 describes a prototype pollution gadget where passing user-provided `fetchOptions` as the second argument to fetch() allows inherited properties from `Object.prototype` to override sanitized request headers. The target (axios v1.7.9-tuxcare.4) does NOT have this vulnerable pattern. The target's fetch adapter calls `fetch(request)` with only one argument (line 272), never passing ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:0320a903-c8f9-5d30-95fd-8153abc9046d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d9a11835-5c42-5068-be84-3bfd45d12286", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25639 does not affect version 1.7.9-tuxcare.5 of axios. Version 1.7.9 is not vulnerable. Summary: The target repository (axios v1.7.9) is NOT vulnerable to CVE-2026-25639. The target uses Object.assign({}, config1, config2) for key iteration, which does not include __proto__ in Object.keys() results, preventing the DoS crash. The vulnerable code pattern was introduced later in v1.11.0 when the code was refactored to use the spread operator ({...config1, ...config2}). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d4c46513-c8db-594d-b6f9-f2d50fce668d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 1.7.9-tuxcare.5 of axios. not_affected \u2014 The target axios version 1.7.9-tuxcare.5 is NOT AFFECTED by CVE-2026-39865. The vulnerability exists in axios's HTTP/2 session cleanup logic within the Http2Sessions class, but HTTP/2 support was not introduced to axios until version 1.13.0 (October 2025). The target version (1.7.9) predates this feature introduction by several major versions. Exhaustive code analysis confirms: no http2 module ...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:86b7bc57-dc2f-5e98-826a-1b920ad59380", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:415cd251-b04e-521a-be90-cad23a33abd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:8baecbed-eaa6-58dc-ad05-3d247a80d602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:e6af6234-47a3-5932-acc6-6f91e7e54003", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:9408b7d6-89e7-58a5-b046-934137438202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:8b57ce7f-4f27-5464-bbd0-cf27f546f79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42037 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:eb6d0e14-33ee-50d3-81c1-3c241a64df7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:644bc3e0-9c97-5d3b-98f5-0a7fec48d469", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:89e6243e-4a5c-5d26-8283-0e7477fedadc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:22f4a5e8-7b96-53e8-82e6-692101824391", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:63197539-757d-5271-b74c-77dae5d58120", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:1ea1d49c-c620-5769-8e18-51be0b9f3d5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42043 does not affect version 1.7.9-tuxcare.5 of axios. Version 1.7.9 is not vulnerable. Summary: The target version (axios v1.7.9) is NOT vulnerable to CVE-2026-42043 because the vulnerable shouldBypassProxy feature does not exist in this version. The target uses the external 'proxy-from-env' package for proxy handling, whereas the vulnerability exists in axios's own shouldBypassProxy implementation that was only introduced in version 1.15.0. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:631909f2-9469-5c0d-a614-be8845e8843f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42044 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:f1e73256-e759-5b72-9b14-6349205fe9a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42264 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:f12b5b0d-d4aa-5f1d-8b91-f55534a7ef5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:2872fbbb-741b-5e13-b932-380ef0d54a5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:ca96ac3d-1c89-55d6-923d-011d540d5ab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44488 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:37af239d-909e-5587-a58f-61502d84da23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44489 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:03be1654-0058-59e4-a65c-61425b836ed1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:0a3818b2-11d0-5b19-96a2-82d7ba4bf245", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44492 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:b49b4172-03ed-5b63-8f73-2639253246bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44494 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d65a0dab-64ea-501c-b184-699ff736f7b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:86771b11-c5de-557b-86a4-3be13d20ec79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:caaad406-3ec4-52d7-9e23-72ec60d0dbeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67312 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:9dcaaf41-7a4c-5494-94c4-0dde588b3f4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67313 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:37cae699-62ce-5548-b392-794ad642b341", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:7c35e309-734f-5f0e-b062-cfea96b5021c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:515f53c3-b5a6-5271-83cf-e5b913a25d07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:7974d3b5-0632-573c-99ba-f95b9a1a64a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67317 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:9c543cf0-cdc4-5871-b9fc-6babf207f965", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 1.7.9-tuxcare.5 of axios. not_affected \u2014 axios 1.7.9-tuxcare.5 has no HTTP/2 transport at all, so the CVE's bypass (streamed body over httpVersion: 2 skipping the byte-counting wrapper) cannot occur. Streamed uploads go through either follow-redirects, which enforces maxBodyLength, or the native http/https transport, which uses a byte-counting Transform. I could not fetch the patch URL, so I derived the fix from the CVE text.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:ab67b5f6-dbae-530d-b066-fc982a565594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:67e6c611-8864-537a-bd0c-664b02f2372f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:5d84ea74-dd11-5d16-81f7-64ea3ddb10bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67321 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:ed3e4c56-8c07-554e-9f7b-31ac80d0dde1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:98b4b00d-e68d-5542-86eb-7c30d8e4362d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d5e0697f-9f23-5d92-9ef7-c5c0e502035f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-42h9-826w-cgv3", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:5c30b1d8-7c8c-5e51-9b58-53c438c242b0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-42h9-826w-cgv3 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:deaf84e4-846a-54bf-a6bc-000cfe7bba32", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:e65daee3-f493-55a1-ac7c-a305b0a02f9c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:4d0073bf-92d2-5c19-babf-02f9f6fc2e79", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:50669320-dcb3-5170-8571-06a20f80d5be", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:fc9fb8e3-3106-5235-b3a7-68741331efd7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:53e3c36c-0feb-5fb2-b98d-301b255e630b", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d4b831b2-cc04-5b37-9114-859f56ad19e1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:257d576a-3ff0-550d-84a4-3ffb115f8ce3", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-jqh4-m9w3-8hp9", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:a4fdc8dc-ce95-51f1-b245-100946a9b6ba", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jqh4-m9w3-8hp9 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:a372f29d-65db-590c-bcee-3c648686cac5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-pmv8-rq9r-6j72", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:42b90e73-271a-5ea7-84c7-5e1b2c36c74b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-pmv8-rq9r-6j72 is fixed in version 1.7.9-tuxcare.5 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ] }