{ "@id": "urn:uuid:c1754011-9ddb-4940-86b4-d93b902f5edc", "role": "Document Creator", "author": "https://tuxcare.com", "version": 17, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:35:05.216685+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 0.26.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-04T11:14:00.048324+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 0.26.0 of axios. not_affected \u2014 CVE-2020-28168 affects axios 0.21.0, where HTTP redirects bypass proxy settings, allowing SSRF attacks. The target version 0.26.0-tuxcare.5 is NOT AFFECTED because the upstream vendor (axios project) already fixed this vulnerability in version 0.21.1 (November 2020, commit c7329fef by Daniel Lopretto). The fix adds a beforeRedirect hook that re-applies proxy configuration to all redirect hops, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 CVE-2020-28168 affects axios 0.21.0, where HTTP redirects bypass proxy settings, allowing SSRF attacks. The target version 0.26.0-tuxcare.5 is NOT AFFECTED because the upstream vendor (axios project) already fixed this vulnerability in version 0.21.1 (November 2020, commit c7329fef by Daniel Lopretto). The fix adds a beforeRedirect hook that re-applies proxy configuration to all redirect hops, ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2023-45857 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.1.", "vulnerability": { "name": "CVE-2023-45857" }, "action_statement": "Vulnerability CVE-2023-45857 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-39338 does not affect version 0.26.0 of axios. not_affected \u2014 Axios 0.26.0 is NOT AFFECTED by CVE-2024-39338. The vulnerability requires the WHATWG URL API (new URL()) which treats protocol-relative URLs (//host) as valid URLs that resolve against a base. Version 0.26.0 uses the legacy Node.js url.parse() API, which does not resolve protocol-relative URLs to hostnames, breaking the SSRF attack chain. Tested behavior confirms that requests with protocol-re...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2024-39338" }, "impact_statement": "not_affected \u2014 Axios 0.26.0 is NOT AFFECTED by CVE-2024-39338. The vulnerability requires the WHATWG URL API (new URL()) which treats protocol-relative URLs (//host) as valid URLs that resolve against a base. Version 0.26.0 uses the legacy Node.js url.parse() API, which does not resolve protocol-relative URLs to hostnames, breaking the SSRF attack chain. Tested behavior confirms that requests with protocol-re..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 0.26.0.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62718 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2025-62718" }, "action_statement": "Vulnerability CVE-2025-62718 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-04T11:49:47.810575+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 0.26.0 of axios. not_affected \u2014 Target axios version 0.26.0 is not affected by CVE-2026-39865. This vulnerability exists only in the HTTP/2 session cleanup logic introduced in axios v1.13.0 (October 2025). Version 0.26.0, released February 2022, predates HTTP/2 support by over 3 years and does not contain the Http2Sessions class or any HTTP/2 session handling code. The vulnerable INPUT (HTTP/2 session close events) cannot be ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 Target axios version 0.26.0 is not affected by CVE-2026-39865. This vulnerability exists only in the HTTP/2 session cleanup logic introduced in axios v1.13.0 (October 2025). Version 0.26.0, released February 2022, predates HTTP/2 support by over 3 years and does not contain the Http2Sessions class or any HTTP/2 session handling code. The vulnerable INPUT (HTTP/2 session close events) cannot be ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40175 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-40175" }, "action_statement": "Vulnerability CVE-2026-40175 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42034 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42034" }, "action_statement": "Vulnerability CVE-2026-42034 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42035 does not affect version 0.26.0 of axios. not_affected \u2014 The target axios version 0.26.0 is not affected by CVE-2026-42035. The vulnerability requires two components that work together: (1) duck-type FormData detection that can be fooled by prototype pollution, and (2) code that calls getHeaders() on the data object and merges the result into request headers. Version 0.26.0 lacks both components. The http adapter does not contain the vulnerable code ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42035" }, "impact_statement": "not_affected \u2014 The target axios version 0.26.0 is not affected by CVE-2026-42035. The vulnerability requires two components that work together: (1) duck-type FormData detection that can be fooled by prototype pollution, and (2) code that calls getHeaders() on the data object and merges the result into request headers. Version 0.26.0 lacks both components. The http adapter does not contain the vulnerable code ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42036 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42036" }, "action_statement": "Vulnerability CVE-2026-42036 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-04T12:17:42.127043+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 0.26.0 of axios. not_affected \u2014 Axios 0.26.0-tuxcare.5 is not affected by CVE-2026-42037. The vulnerable file `lib/helpers/formDataToStream.js` and the `FormDataPart` class do not exist in this version. Manual multipart form-data construction with `value.type` interpolation was introduced in axios 1.x (circa 2024-2025). Axios 0.26.0 delegates FormData handling to external implementations or passes data directly to Node.js's h...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 Axios 0.26.0-tuxcare.5 is not affected by CVE-2026-42037. The vulnerable file `lib/helpers/formDataToStream.js` and the `FormDataPart` class do not exist in this version. Manual multipart form-data construction with `value.type` interpolation was introduced in axios 1.x (circa 2024-2025). Axios 0.26.0 delegates FormData handling to external implementations or passes data directly to Node.js's h..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42038 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42038" }, "action_statement": "Vulnerability CVE-2026-42038 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 0.26.0 of axios. not_affected \u2014 The vulnerable buildFormData function exists in version 0.26.0 but is unreachable from axios's own production code. Unlike the affected versions (1.7.x) where toFormData is actively used for params serialization via AxiosURLSearchParams, version 0.26.0 uses a completely different architecture that does not invoke toFormData at all. The CVE's attack path 'axios({ data, params })' does not reach ...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 The vulnerable buildFormData function exists in version 0.26.0 but is unreachable from axios's own production code. Unlike the affected versions (1.7.x) where toFormData is actively used for params serialization via AxiosURLSearchParams, version 0.26.0 uses a completely different architecture that does not invoke toFormData at all. The CVE's attack path 'axios({ data, params })' does not reach ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 0.26.0 of axios. not_affected \u2014 Version 0.26.0 is not affected by CVE-2026-42040. The vulnerable file lib/helpers/AxiosURLSearchParams.js does not exist in this version. It was introduced on 2022-05-25 (commit 934f390c), three months after v0.26.0 was released on 2022-02-13. The target uses lib/helpers/buildURL.js for URL parameter encoding, which does not contain the problematic charMap entry that reverses null byte encoding...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 Version 0.26.0 is not affected by CVE-2026-42040. The vulnerable file lib/helpers/AxiosURLSearchParams.js does not exist in this version. It was introduced on 2022-05-25 (commit 934f390c), three months after v0.26.0 was released on 2022-02-13. The target uses lib/helpers/buildURL.js for URL parameter encoding, which does not contain the problematic charMap entry that reverses null byte encoding..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42041 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42041" }, "action_statement": "Vulnerability CVE-2026-42041 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 0.26.0 of axios. not_affected \u2014 Version 0.26.0 is not affected by CVE-2026-42042. The vulnerable withXSRFToken configuration property does not exist in this version - it was introduced in later versions (1.x+). Version 0.26.0 uses an older XSRF token architecture based on withCredentials, which is handled in lib/adapters/xhr.js rather than the lib/helpers/resolveConfig.js file that contains the vulnerability in newer versions.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 Version 0.26.0 is not affected by CVE-2026-42042. The vulnerable withXSRFToken configuration property does not exist in this version - it was introduced in later versions (1.x+). Version 0.26.0 uses an older XSRF token architecture based on withCredentials, which is handled in lib/adapters/xhr.js rather than the lib/helpers/resolveConfig.js file that contains the vulnerability in newer versions." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-04T12:11:00.125369+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 0.26.0 of axios. not_affected \u2014 The target (axios v0.26.0) does not contain the vulnerable code pattern described in CVE-2026-42044. The parseReviver feature that enables the gadget (JSON.parse with this.parseReviver parameter) was not added to axios until August 2025, over 3 years after v0.26.0 was released in February 2022. The actual code at lib/defaults.js:89 calls JSON.parse(data) with no reviver parameter. The CVE's cla...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 The target (axios v0.26.0) does not contain the vulnerable code pattern described in CVE-2026-42044. The parseReviver feature that enables the gadget (JSON.parse with this.parseReviver parameter) was not added to axios until August 2025, over 3 years after v0.26.0 was released in February 2022. The actual code at lib/defaults.js:89 calls JSON.parse(data) with no reviver parameter. The CVE's cla..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 0.26.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-04T12:56:42.394644+00:00", "status_notes": "Vulnerability CVE-2026-44489 does not affect version 0.26.0 of axios. not_affected \u2014 CVE-2026-44489 describes a prototype pollution bypass in Axios 1.15.2 where polluted Object.prototype.username/password/auth can inject attacker-controlled credentials into Proxy-Authorization headers. The target version 0.26.0-tuxcare.5 is NOT AFFECTED because: (1) the vulnerable code paths (direct proxy.username/password reads without guards) introduced in 1.15.2 do not exist in this older ve...", "vulnerability": { "name": "CVE-2026-44489" }, "impact_statement": "not_affected \u2014 CVE-2026-44489 describes a prototype pollution bypass in Axios 1.15.2 where polluted Object.prototype.username/password/auth can inject attacker-controlled credentials into Proxy-Authorization headers. The target version 0.26.0-tuxcare.5 is NOT AFFECTED because: (1) the vulnerable code paths (direct proxy.username/password reads without guards) introduced in 1.15.2 do not exist in this older ve..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44490 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-44490" }, "action_statement": "Vulnerability CVE-2026-44490 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T22:35:00.141426+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 0.26.0 of axios. not_affected \u2014 The target axios 0.26.0 is NOT AFFECTED by CVE-2026-67312. The vulnerability exists in the formDataToJSON function (exposed as axios.formToJSON()) which parses FormData field names with bracket notation and is susceptible to stack overflow via deeply nested brackets. However, this function was introduced in axios v0.27.2 (commit c008e57f), AFTER the target version 0.26.0. Exhaustive searches co...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 The target axios 0.26.0 is NOT AFFECTED by CVE-2026-67312. The vulnerability exists in the formDataToJSON function (exposed as axios.formToJSON()) which parses FormData field names with bracket notation and is susceptible to stack overflow via deeply nested brackets. However, this function was introduced in axios v0.27.2 (commit c008e57f), AFTER the target version 0.26.0. Exhaustive searches co..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-06T21:10:00.052557+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 0.26.0 of axios. not_affected \u2014 axios 0.26.0-tuxcare.5 has no formDataToJSON helper, no axios.formToJSON API, and no FormData-to-JSON request transform. The CVE says the vulnerable helper was introduced in 0.28.0, so this older codebase does not contain the vulnerable recursive code. The patch itself was not available, only commit URLs, so the analysis rests on the CVE text.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 axios 0.26.0-tuxcare.5 has no formDataToJSON helper, no axios.formToJSON API, and no FormData-to-JSON request transform. The CVE says the vulnerable helper was introduced in 0.28.0, so this older codebase does not contain the vulnerable recursive code. The patch itself was not available, only commit URLs, so the analysis rests on the CVE text." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67315 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-67315" }, "action_statement": "Vulnerability CVE-2026-67315 affects version 0.26.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-10-25T02:03:00.078928+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.5.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.5." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-06T21:14:05.819520+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 0.26.0 of axios. not_affected \u2014 axios 0.26.0-tuxcare.5 has no fetch adapter. The CVE concerns lib/adapters/fetch.js, which was introduced in axios 1.x. This tree has only lib/adapters/http.js and lib/adapters/xhr.js. The HTTP adapter already counts streamed upload bytes and rejects past maxBodyLength, so unknown-length streams cannot send an oversized body.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 axios 0.26.0-tuxcare.5 has no fetch adapter. The CVE concerns lib/adapters/fetch.js, which was introduced in axios 1.x. This tree has only lib/adapters/http.js and lib/adapters/xhr.js. The HTTP adapter already counts streamed upload bytes and rejects past maxBodyLength, so unknown-length streams cannot send an oversized body." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-06T21:20:00.118356+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 0.26.0 of axios. not_affected \u2014 Target is axios 0.26.0-tuxcare.5. It has no HTTP/2 transport and no httpVersion option, so the vulnerable path (a stream body sent over HTTP/2 with maxBodyLength never enforced) does not exist. The target uses only http/https or follow-redirects. Streamed uploads on the native transport go through a byte-counting limiter, and follow-redirects enforces maxBodyLength on the redirect-following path.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 Target is axios 0.26.0-tuxcare.5. It has no HTTP/2 transport and no httpVersion option, so the vulnerable path (a stream body sent over HTTP/2 with maxBodyLength never enforced) does not exist. The target uses only http/https or follow-redirects. Streamed uploads on the native transport go through a byte-counting limiter, and follow-redirects enforces maxBodyLength on the redirect-following path." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 0.26.0 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 0.26.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-06T21:35:05.216685+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 0.26.0 of axios. not_affected \u2014 Target is the axios 0.26.0 line (0.26.0-tuxcare.5). The CVE concerns a bypass of the maxDepth guard (added in axios 1.15.0) through the top-level '{}' metatoken shortcut in defaultVisitor, which JSON.stringify's the value before build() checks depth. Neither the shortcut nor the guard exists in this target. toFormData.js here is a small recursive helper with no metaTokens or '{}' handling, and ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Target is the axios 0.26.0 line (0.26.0-tuxcare.5). The CVE concerns a bypass of the maxDepth guard (added in axios 1.15.0) through the top-level '{}' metatoken shortcut in defaultVisitor, which JSON.stringify's the value before build() checks depth. Neither the shortcut nor the guard exists in this target. toFormData.js here is a small recursive helper with no metaTokens or '{}' handling, and ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4.", "vulnerability": { "name": "GHSA-7q8q-rj6j-mhjq" }, "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.4." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.26.0.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@0.26.0", "identifiers": { "purl": "pkg:npm/axios@0.26.0" } } ], "timestamp": "2026-10-25T02:03:00.078928+00:00", "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.5.", "vulnerability": { "name": "GHSA-mmx7-hfxf-jppx" }, "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.26.0 of axios, and is fixed in 0.26.0-tuxcare.5." } ] }