{ "@id": "urn:uuid:5c177eb8-9a7d-458d-bdd6-6b078f8afc03", "role": "Document Creator", "author": "https://tuxcare.com", "version": 20, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-13T10:43:00.052852+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2020-28168 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2020-28168" }, "action_statement": "Vulnerability CVE-2020-28168 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2023-45857 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2023-45857" }, "action_statement": "Vulnerability CVE-2023-45857 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 1.15.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.15.2.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-62718 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2025-62718" }, "action_statement": "Vulnerability CVE-2025-62718 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-09-30T15:22:01.103634+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-13T10:43:00.052852+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-13T10:43:00.052852+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-09-30T15:22:01.103634+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-13T10:43:00.052852+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-13T10:43:00.052852+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-07T15:10:00.067011+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-09-30T15:22:01.103634+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-13T10:43:00.052852+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-09-30T15:22:01.103634+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-39865 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-39865" }, "action_statement": "Vulnerability CVE-2026-39865 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-40175 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-40175" }, "action_statement": "Vulnerability CVE-2026-40175 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 1.15.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:26:27.881310+00:00", "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.15.2 of axios. not_affected \u2014 Target axios 1.15.2 already contains the upstream fix for CVE-2026-42034 (upstream commit 1c7f6d76, \"enforce max body length when max redirects is 0\"). The streamed-upload path with maxRedirects===0 now pipes the body through a byte-counting Transform that errors once maxBodyLength is exceeded. The fix shipped in the upstream 1.15.2 release, before any TuxCare commit, so this is an upstream fix...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42034" }, "impact_statement": "not_affected \u2014 Target axios 1.15.2 already contains the upstream fix for CVE-2026-42034 (upstream commit 1c7f6d76, \"enforce max body length when max redirects is 0\"). The streamed-upload path with maxRedirects===0 now pipes the body through a byte-counting Transform that errors once maxBodyLength is exceeded. The fix shipped in the upstream 1.15.2 release, before any TuxCare commit, so this is an upstream fix..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 1.15.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:26:00.092216+00:00", "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.15.2 of axios. not_affected \u2014 Axios 1.15.2 already contains the upstream fix for CVE-2026-42036 (upstream commit e8904af0, \"fix: stream response bypassed max content length\"). In lib/adapters/http.js, the responseType 'stream' branch now wraps the response stream in a byte-counting generator that throws AxiosError once maxContentLength is exceeded. The fix shipped in the upstream release, and the only TuxCare-side commits a...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42036" }, "impact_statement": "not_affected \u2014 Axios 1.15.2 already contains the upstream fix for CVE-2026-42036 (upstream commit e8904af0, \"fix: stream response bypassed max content length\"). In lib/adapters/http.js, the responseType 'stream' branch now wraps the response stream in a byte-counting generator that throws AxiosError once maxContentLength is exceeded. The fix shipped in the upstream release, and the only TuxCare-side commits a..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:27:00.065199+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 1.15.2 of axios. not_affected \u2014 The target (axios 1.15.2) already contains the upstream fix. FormDataPart strips CR and LF from value.type before it goes into the per-part Content-Type header. The fix, upstream commit 75873270 \"fix: strip crlf correctly\", shipped in the 1.15.2 release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 The target (axios 1.15.2) already contains the upstream fix. FormDataPart strips CR and LF from value.type before it goes into the per-part Content-Type header. The fix, upstream commit 75873270 \"fix: strip crlf correctly\", shipped in the 1.15.2 release that TuxCare onboarded, so this is an upstream fix and not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:27:00.065199+00:00", "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.15.2 of axios. not_affected \u2014 Axios 1.15.2 already contains the loopback-equivalence fix for CVE-2026-42038. shouldBypassProxy() treats localhost, any 127.x.x.x address and the IPv6 loopback forms as equivalent when matching against no_proxy. The fix is upstream commit e033f243 (author jasonsaayman@gmail.com, committer noreply@github.com). It is part of the upstream 1.15.2 release, and HEAD has no TuxCare-domain commits.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42038" }, "impact_statement": "not_affected \u2014 Axios 1.15.2 already contains the loopback-equivalence fix for CVE-2026-42038. shouldBypassProxy() treats localhost, any 127.x.x.x address and the IPv6 loopback forms as equivalent when matching against no_proxy. The fix is upstream commit e033f243 (author jasonsaayman@gmail.com, committer noreply@github.com). It is part of the upstream 1.15.2 release, and HEAD has no TuxCare-domain commits." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:26:27.881310+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.15.2 of axios. not_affected \u2014 The target (axios 1.15.2) already has the upstream depth-limit fix in lib/helpers/toFormData.js. The fix is upstream commit 85132ff (\"fix: form data recursion\", #10726), which is part of the 1.15.2 release. build() now takes a depth argument and throws AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED once depth exceeds maxDepth (default 100). The unbounded recursion no longer exists.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 The target (axios 1.15.2) already has the upstream depth-limit fix in lib/helpers/toFormData.js. The fix is upstream commit 85132ff (\"fix: form data recursion\", #10726), which is part of the 1.15.2 release. build() now takes a depth argument and throws AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED once depth exceeds maxDepth (default 100). The unbounded recursion no longer exists." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:26:00.092216+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 1.15.2 of axios. not_affected \u2014 The target (axios 1.15.2) already contains the upstream fix. The `'%00': '\\x00'` charMap entry and the `|%00` regex alternative are gone from lib/helpers/AxiosURLSearchParams.js. A NUL character therefore stays percent-encoded as `%00` in the serialized output. The fix, upstream commit 5266af94 (\"fix: improve regex in AxiosURLSearchParams (#10736)\"), shipped in the upstream 1.15.2 release.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 The target (axios 1.15.2) already contains the upstream fix. The `'%00': '\\x00'` charMap entry and the `|%00` regex alternative are gone from lib/helpers/AxiosURLSearchParams.js. A NUL character therefore stays percent-encoded as `%00` in the serialized output. The fix, upstream commit 5266af94 (\"fix: improve regex in AxiosURLSearchParams (#10736)\"), shipped in the upstream 1.15.2 release." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:27:00.065199+00:00", "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.15.2 of axios. not_affected \u2014 Axios 1.15.2 already contains the upstream fix (commit 42eb721e, \"replace in with has own prop util\"). mergeDirectKeys uses own-property checks instead of the `in` operator. The merged config is also a null-prototype object. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits, so this is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42041" }, "impact_statement": "not_affected \u2014 Axios 1.15.2 already contains the upstream fix (commit 42eb721e, \"replace in with has own prop util\"). mergeDirectKeys uses own-property checks instead of the `in` operator. The merged config is also a null-prototype object. The fix shipped in the upstream release, and HEAD has no TuxCare-domain commits, so this is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:27:00.065199+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.15.2 of axios. not_affected \u2014 axios 1.15.2 already contains the upstream fix for CVE-2026-42042. resolveConfig.js decides XSRF header forwarding with a strict check: `withXSRFToken === true || (withXSRFToken == null && isURLSameOrigin(url))`. The fix is upstream commit 1728aa1b, which is part of the upstream 1.15.2 release. Truthy non-boolean values such as 1, \"false\" or {} no longer skip the same-origin check.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 axios 1.15.2 already contains the upstream fix for CVE-2026-42042. resolveConfig.js decides XSRF header forwarding with a strict check: `withXSRFToken === true || (withXSRFToken == null && isURLSameOrigin(url))`. The fix is upstream commit 1728aa1b, which is part of the upstream 1.15.2 release. Truthy non-boolean values such as 1, \"false\" or {} no longer skip the same-origin check." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 1.15.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-06T20:27:00.065199+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 1.15.2 of axios. not_affected \u2014 Target axios 1.15.2 already contains an upstream fix. The default transformResponse reads parseReviver through an own-property helper, so a polluted Object.prototype.parseReviver is ignored. The fix shipped in the upstream release, so the verdict is not_affected, not already_fixed.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 Target axios 1.15.2 already contains an upstream fix. The default transformResponse reads parseReviver through an own-property helper, so a polluted Object.prototype.parseReviver is ignored. The fix shipped in the upstream release, so the verdict is not_affected, not already_fixed." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-07T15:10:00.067011+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:25:09.397202+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:25:09.397202+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-07T15:10:00.067011+00:00", "status_notes": "Vulnerability CVE-2026-44489 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44489" }, "action_statement": "Vulnerability CVE-2026-44489 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-07T15:10:00.067011+00:00", "status_notes": "Vulnerability CVE-2026-44490 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44490" }, "action_statement": "Vulnerability CVE-2026-44490 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-07T15:10:00.067011+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:23:00.585347+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-07T15:10:00.067011+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 1.15.2 of axios, and is fixed in 1.15.2-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:21:00.158031+00:00", "status_notes": "Vulnerability CVE-2026-67312 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67312" }, "action_statement": "Vulnerability CVE-2026-67312 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:20:00.281317+00:00", "status_notes": "Vulnerability CVE-2026-67313 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67313" }, "action_statement": "Vulnerability CVE-2026-67313 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:21:00.158031+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:20:00.281317+00:00", "status_notes": "Vulnerability CVE-2026-67315 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67315" }, "action_statement": "Vulnerability CVE-2026-67315 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:22:00.210457+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:21:00.158031+00:00", "status_notes": "Vulnerability CVE-2026-67317 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67317" }, "action_statement": "Vulnerability CVE-2026-67317 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:21:00.158031+00:00", "status_notes": "Vulnerability CVE-2026-67318 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67318" }, "action_statement": "Vulnerability CVE-2026-67318 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:20:00.281317+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:20:00.281317+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 1.15.2 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-15T13:19:24.566663+00:00", "status_notes": "Vulnerability CVE-2026-67321 affects version 1.15.2 of axios.", "vulnerability": { "name": "CVE-2026-67321" }, "action_statement": "Vulnerability CVE-2026-67321 affects version 1.15.2 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.15.2", "identifiers": { "purl": "pkg:npm/axios@1.15.2" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.15.2.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." } ] }