{ "@id": "urn:uuid:01f64f8f-f8fb-4990-8221-6849e42c7e01", "role": "Document Creator", "author": "https://tuxcare.com", "version": 18, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:33:27.229630+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 0.21.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-04T11:12:00.042345+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 0.21.1 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is not present in axios 0.21.1. The vulnerability was fixed in upstream commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto, which was already included in the upstream 0.21.1 release before TuxCare onboarded this version. The fix adds a beforeRedirect callback in lib/adapters/http.js that ensures all HTTP redirects maintain proxy...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is not present in axios 0.21.1. The vulnerability was fixed in upstream commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto, which was already included in the upstream 0.21.1 release before TuxCare onboarded this version. The fix adds a beforeRedirect callback in lib/adapters/http.js that ensures all HTTP redirects maintain proxy..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45857 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2023-45857" }, "action_statement": "Vulnerability CVE-2023-45857 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39338 does not affect version 0.21.1 of axios. already_fixed \u2014 The target axios 0.21.1-tuxcare.1 already contains equivalent defense logic against CVE-2024-39338 (protocol-relative URL SSRF) through the 'allowAbsoluteUrls' parameter added in CVE-2025-27152 backport (commit bc6d5a0b). When set to false, this parameter forces baseURL concatenation for protocol-relative URLs, preventing SSRF. The defense code exists in the codebase and is reachable on all exe...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2024-39338" }, "impact_statement": "already_fixed \u2014 The target axios 0.21.1-tuxcare.1 already contains equivalent defense logic against CVE-2024-39338 (protocol-relative URL SSRF) through the 'allowAbsoluteUrls' parameter added in CVE-2025-27152 backport (commit bc6d5a0b). When set to false, this parameter forces baseURL concatenation for protocol-relative URLs, preventing SSRF. The defense code exists in the codebase and is reachable on all exe..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 0.21.1.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62718 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2025-62718" }, "action_statement": "Vulnerability CVE-2025-62718 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-04T11:48:00.196671+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 0.21.1 of axios. not_affected \u2014 The target axios version 0.21.1-tuxcare.5 is not affected by CVE-2026-39865. This vulnerability exists exclusively in the HTTP/2 session management code (Http2Sessions class) which was introduced in axios v1.13.0 (October 2025), 760 commits after the v0.21.1 release. The target version predates HTTP/2 support and uses only HTTP/1.x adapters via Node.js http/https modules. The vulnerable code pa...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 The target axios version 0.21.1-tuxcare.5 is not affected by CVE-2026-39865. This vulnerability exists exclusively in the HTTP/2 session management code (Http2Sessions class) which was introduced in axios v1.13.0 (October 2025), 760 commits after the v0.21.1 release. The target version predates HTTP/2 support and uses only HTTP/1.x adapters via Node.js http/https modules. The vulnerable code pa..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40175 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-40175" }, "action_statement": "Vulnerability CVE-2026-40175 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42034 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42034" }, "action_statement": "Vulnerability CVE-2026-42034 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42036 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42036" }, "action_statement": "Vulnerability CVE-2026-42036 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-04T12:14:00.061372+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 0.21.1 of axios. not_affected \u2014 CVE-2026-42037 affects axios versions that contain lib/helpers/formDataToStream.js (introduced in v1.3.0). The target version 0.21.1-tuxcare.5 does not contain this file or any multipart body construction code. In v0.21.1, FormData is delegated to native browser implementations (XHR adapter) or not processed at all (HTTP adapter). The vulnerable code path from Blob .type property to multipart h...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 CVE-2026-42037 affects axios versions that contain lib/helpers/formDataToStream.js (introduced in v1.3.0). The target version 0.21.1-tuxcare.5 does not contain this file or any multipart body construction code. In v0.21.1, FormData is delegated to native browser implementations (XHR adapter) or not processed at all (HTTP adapter). The vulnerable code path from Blob .type property to multipart h..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42038 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42038" }, "action_statement": "Vulnerability CVE-2026-42038 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42039 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42039" }, "action_statement": "Vulnerability CVE-2026-42039 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42040 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42040" }, "action_statement": "Vulnerability CVE-2026-42040 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42041 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42041" }, "action_statement": "Vulnerability CVE-2026-42041 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42042 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42042" }, "action_statement": "Vulnerability CVE-2026-42042 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-04T12:11:00.125369+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 0.21.1 of axios. not_affected \u2014 Axios 0.21.1 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern (JSON.parse with this.parseReviver parameter) does not exist in version 0.21.1. The parseReviver feature was introduced in axios v1.x in August 2025 (commit 2a976342), years after the 0.21.1 release. The CVE's claim of \"All versions (v0.x - v1.x)\" is incorrect.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 Axios 0.21.1 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern (JSON.parse with this.parseReviver parameter) does not exist in version 0.21.1. The parseReviver feature was introduced in axios v1.x in August 2025 (commit 2a976342), years after the 0.21.1 release. The CVE's claim of \"All versions (v0.x - v1.x)\" is incorrect." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44489 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-44489" }, "action_statement": "Vulnerability CVE-2026-44489 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-10-15T12:45:05.757304+00:00", "status_notes": "Vulnerability CVE-2026-44490 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44490" }, "action_statement": "Vulnerability CVE-2026-44490 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-10-15T12:45:05.757304+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-10-15T12:45:05.757304+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T22:32:51.353772+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 0.21.1 of axios. not_affected \u2014 axios v0.21.1 is not affected by CVE-2026-67312. The vulnerable formDataToJSON function (lib/helpers/formDataToJSON.js) and its recursive buildPath helper do not exist in this version. Version 0.21.1 lacks any FormData-to-JSON serialization capability - FormData objects are passed through unchanged to the transport layer without parsing field names or constructing nested objects. The CVE affect...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 axios v0.21.1 is not affected by CVE-2026-67312. The vulnerable formDataToJSON function (lib/helpers/formDataToJSON.js) and its recursive buildPath helper do not exist in this version. Version 0.21.1 lacks any FormData-to-JSON serialization capability - FormData objects are passed through unchanged to the transport layer without parsing field names or constructing nested objects. The CVE affect..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-06T21:10:00.052557+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 0.21.1 of axios. not_affected \u2014 Target is axios 0.21.1-tuxcare.5. The CVE concerns uncontrolled recursion in formDataToJSON / formToJSON, which axios added in 0.28.0 (the advisory says earlier versions lack it). This tree has no formDataToJSON.js, no formToJSON API, and no FormData-to-JSON path in the default transformRequest. The commits at the patch URLs were not retrievable offline, so I could not check whether they also t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 Target is axios 0.21.1-tuxcare.5. The CVE concerns uncontrolled recursion in formDataToJSON / formToJSON, which axios added in 0.28.0 (the advisory says earlier versions lack it). This tree has no formDataToJSON.js, no formToJSON API, and no FormData-to-JSON path in the default transformRequest. The commits at the patch URLs were not retrievable offline, so I could not check whether they also t..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67315 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-67315" }, "action_statement": "Vulnerability CVE-2026-67315 affects version 0.21.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-10-25T00:32:35.709153+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.5.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-06T21:14:00.043521+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 0.21.1 of axios. not_affected \u2014 axios 0.21.1-tuxcare.5 has no fetch adapter. The only adapters are lib/adapters/http.js and lib/adapters/xhr.js. The CVE concerns lib/adapters/fetch.js, which was added in much later axios versions and is absent here. Unknown-length stream uploads do exist in the Node HTTP adapter, but that path already counts bytes and rejects past maxBodyLength. The CVE itself lists the HTTP adapter as not af...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 axios 0.21.1-tuxcare.5 has no fetch adapter. The only adapters are lib/adapters/http.js and lib/adapters/xhr.js. The CVE concerns lib/adapters/fetch.js, which was added in much later axios versions and is absent here. Unknown-length stream uploads do exist in the Node HTTP adapter, but that path already counts bytes and rejects past maxBodyLength. The CVE itself lists the HTTP adapter as not af..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-06T21:19:00.030345+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 0.21.1 of axios. not_affected \u2014 axios 0.21.1-tuxcare.5 has no HTTP/2 support (no httpVersion option, no http2 transport). The CVE's chain needs a stream body sent through an HTTP/2 transport that never enforces the size cap, and that transport does not exist here. Streamed uploads in this version go through follow-redirects, which enforces maxBodyLength, or through a native http/https transport behind an axios byte-counting l...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 axios 0.21.1-tuxcare.5 has no HTTP/2 support (no httpVersion option, no http2 transport). The CVE's chain needs a stream body sent through an HTTP/2 transport that never enforces the size cap, and that transport does not exist here. Streamed uploads in this version go through follow-redirects, which enforces maxBodyLength, or through a native http/https transport behind an axios byte-counting l..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-10-15T12:45:05.757304+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 0.21.1 of axios, and is fixed in 0.21.1-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 0.21.1 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 0.21.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-06T21:33:27.229630+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 0.21.1 of axios. not_affected \u2014 Target is axios 0.21.1-tuxcare.5. The vulnerable component (lib/helpers/toFormData.js, with its top-level '{}' key JSON.stringify shortcut and the maxDepth guard that the shortcut bypasses) does not exist in this version. There is no toFormData, AxiosURLSearchParams, toURLEncodedForm, formSerializer or ERR_FORM_DATA_DEPTH_EXCEEDED. The default transforms only JSON.stringify objects (lib/default...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Target is axios 0.21.1-tuxcare.5. The vulnerable component (lib/helpers/toFormData.js, with its top-level '{}' key JSON.stringify shortcut and the maxDepth guard that the shortcut bypasses) does not exist in this version. There is no toFormData, AxiosURLSearchParams, toURLEncodedForm, formSerializer or ERR_FORM_DATA_DEPTH_EXCEEDED. The default transforms only JSON.stringify objects (lib/default..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.21.1 of axios.", "vulnerability": { "name": "GHSA-7q8q-rj6j-mhjq" }, "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.21.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.21.1.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.21.1", "identifiers": { "purl": "pkg:npm/axios@0.21.1" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.21.1 of axios.", "vulnerability": { "name": "GHSA-mmx7-hfxf-jppx" }, "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.21.1 of axios." } ] }