{ "@id": "urn:uuid:0fc16ed1-9a9a-46c1-ab56-653cf568999a", "role": "Document Creator", "author": "https://tuxcare.com", "version": 26, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T11:41:35.274342+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T11:16:00.077593+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirects) is NOT present in axios v1.17.0-tuxcare.3. The upstream fix (commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto, Nov 2020) was already included in the upstream v1.17.0 release before TuxCare's maintenance work began. The defense code is present at lib/adapters/http.js lines 335-339, where a beforeRedirects.proxy callback reappl...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirects) is NOT present in axios v1.17.0-tuxcare.3. The upstream fix (commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto, Nov 2020) was already included in the upstream v1.17.0 release before TuxCare's maintenance work began. The defense code is present at lib/adapters/http.js lines 335-339, where a beforeRedirects.proxy callback reappl..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T11:33:00.090109+00:00", "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.17.0 of axios. not_affected \u2014 The target repository (axios 1.17.0-tuxcare.3) is NOT affected by CVE-2023-45857. The vulnerability was fixed in upstream commit 96ee232b authored by Valentin Panov, which was already present in the upstream release version 1.17.0 before TuxCare onboarded it. The fix restricts XSRF token transmission to same-origin requests only, preventing token leakage to cross-origin attackers. The current i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45857" }, "impact_statement": "not_affected \u2014 The target repository (axios 1.17.0-tuxcare.3) is NOT affected by CVE-2023-45857. The vulnerability was fixed in upstream commit 96ee232b authored by Valentin Panov, which was already present in the upstream release version 1.17.0 before TuxCare onboarded it. The fix restricts XSRF token transmission to same-origin requests only, preventing token leakage to cross-origin attackers. The current i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.17.0.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:01:26.373770+00:00", "status_notes": "Vulnerability CVE-2025-62718 does not affect version 1.17.0 of axios. not_affected \u2014 The target Axios 1.17.0-tuxcare.3 is NOT affected by CVE-2025-62718. The vulnerability (NO_PROXY hostname normalization bypass allowing requests to localhost. and [::1] to be proxied despite NO_PROXY rules) was fixed in upstream Axios v1.15.0 by commit fb3befb6. This fix shipped with the upstream 1.17.0 release that TuxCare onboarded, so the vulnerable pattern is not present in the target. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62718" }, "impact_statement": "not_affected \u2014 The target Axios 1.17.0-tuxcare.3 is NOT affected by CVE-2025-62718. The vulnerability (NO_PROXY hostname normalization bypass allowing requests to localhost. and [::1] to be proxied despite NO_PROXY rules) was fixed in upstream Axios v1.15.0 by commit fb3befb6. This fix shipped with the upstream 1.17.0 release that TuxCare onboarded, so the vulnerable pattern is not present in the target. The ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-12T14:22:02.231466+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T11:53:32.685451+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.17.0 of axios. not_affected \u2014 The target axios version 1.17.0-tuxcare.3 is not affected by CVE-2026-39865. The vulnerable array iteration pattern was fixed by upstream commit 12c314b6 (authored by Dmitriy Mozgovoy) which shipped in axios v1.13.2 in November 2025. The fix restructures the Http2Sessions session cleanup logic to always return immediately after removing a session entry, preventing continued iteration over a mod...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 The target axios version 1.17.0-tuxcare.3 is not affected by CVE-2026-39865. The vulnerable array iteration pattern was fixed by upstream commit 12c314b6 (authored by Dmitriy Mozgovoy) which shipped in axios v1.13.2 in November 2025. The fix restructures the Http2Sessions session cleanup logic to always return immediately after removing a session entry, preventing continued iteration over a mod..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:06:25.633063+00:00", "status_notes": "Vulnerability CVE-2026-40175 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2026-40175 (CRLF injection in HTTP headers enabling cloud metadata exfiltration) is NOT present in axios v1.17.0-tuxcare.3. The upstream fix was already included in the v1.17.0 release that TuxCare's branch is based on. The target implements comprehensive CRLF sanitization through lib/helpers/sanitizeHeaderValue.js, which strips control characters (including \\r and \\n) from all header value...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40175" }, "impact_statement": "not_affected \u2014 CVE-2026-40175 (CRLF injection in HTTP headers enabling cloud metadata exfiltration) is NOT present in axios v1.17.0-tuxcare.3. The upstream fix was already included in the v1.17.0 release that TuxCare's branch is based on. The target implements comprehensive CRLF sanitization through lib/helpers/sanitizeHeaderValue.js, which strips control characters (including \\r and \\n) from all header value..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:18:00.086689+00:00", "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2026-42034 (maxBodyLength bypass for streams with maxRedirects=0) is NOT present in axios 1.17.0-tuxcare.3. The upstream fix (commit 1c7f6d76e by Jay, 2026-04-18) was already included in the axios 1.17.0 release before TuxCare onboarding. The fix adds a byte-counting Transform stream (lines 1278-1306 in lib/adapters/http.js) that enforces maxBodyLength for transports that don't apply it the...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42034" }, "impact_statement": "not_affected \u2014 CVE-2026-42034 (maxBodyLength bypass for streams with maxRedirects=0) is NOT present in axios 1.17.0-tuxcare.3. The upstream fix (commit 1c7f6d76e by Jay, 2026-04-18) was already included in the axios 1.17.0 release before TuxCare onboarding. The fix adds a byte-counting Transform stream (lines 1278-1306 in lib/adapters/http.js) that enforces maxBodyLength for transports that don't apply it the..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:38:52.388866+00:00", "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2026-42036 is NOT present in axios 1.17.0-tuxcare.3. The vulnerability (maxContentLength bypass for streamed responses) was fixed by upstream commit e8904af03 authored by Jay (jasonsaayman@gmail.com) on 2026-04-18, which was already included in the upstream axios 1.17.0 release before TuxCare onboarded it. The fix wraps streamed responses in an async generator that enforces maxContentLength...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42036" }, "impact_statement": "not_affected \u2014 CVE-2026-42036 is NOT present in axios 1.17.0-tuxcare.3. The vulnerability (maxContentLength bypass for streamed responses) was fixed by upstream commit e8904af03 authored by Jay (jasonsaayman@gmail.com) on 2026-04-18, which was already included in the upstream axios 1.17.0 release before TuxCare onboarded it. The fix wraps streamed responses in an async generator that enforces maxContentLength..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:17:00.041916+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2026-42037 (CRLF injection in FormData multipart body via unsanitized value.type) is NOT present in axios 1.17.0-tuxcare.3. The vulnerability pattern was removed by upstream commit 75873270 (author jasonsaayman@gmail.com, \"fix: strip crlf correctly #10758\") which shipped in the upstream release before TuxCare branch creation. The fix sanitizes value.type by removing all \\r and \\n characters...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 CVE-2026-42037 (CRLF injection in FormData multipart body via unsanitized value.type) is NOT present in axios 1.17.0-tuxcare.3. The vulnerability pattern was removed by upstream commit 75873270 (author jasonsaayman@gmail.com, \"fix: strip crlf correctly #10758\") which shipped in the upstream release before TuxCare branch creation. The fix sanitizes value.type by removing all \\r and \\n characters..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:31:00.046915+00:00", "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.17.0 of axios. not_affected \u2014 The target axios v1.17.0-tuxcare.3 is NOT AFFECTED by CVE-2026-42038. The vulnerability requires pure string matching in no_proxy bypass logic without loopback address normalization. The target code at lib/helpers/shouldBypassProxy.js:504 implements comprehensive loopback equivalence checking via `(isLoopback(hostname) && isLoopback(entryHost))`, treating localhost, 127.0.0.1, ::1, and other lo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42038" }, "impact_statement": "not_affected \u2014 The target axios v1.17.0-tuxcare.3 is NOT AFFECTED by CVE-2026-42038. The vulnerability requires pure string matching in no_proxy bypass logic without loopback address normalization. The target code at lib/helpers/shouldBypassProxy.js:504 implements comprehensive loopback equivalence checking via `(isLoopback(hostname) && isLoopback(entryHost))`, treating localhost, 127.0.0.1, ::1, and other lo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:19:00.089013+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2026-42039 is NOT present in axios 1.17.0-tuxcare.3. The vulnerability (unbounded recursion in toFormData.js causing stack overflow with deeply nested objects) was fixed by upstream commit 85132ffb, which added depth limiting (maxDepth=100 default) to the recursive build() function. This fix shipped in upstream version v1.15.1 and was already present in the v1.17.0 release that TuxCare onbo...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 CVE-2026-42039 is NOT present in axios 1.17.0-tuxcare.3. The vulnerability (unbounded recursion in toFormData.js causing stack overflow with deeply nested objects) was fixed by upstream commit 85132ffb, which added depth limiting (maxDepth=100 default) to the recursive build() function. This fix shipped in upstream version v1.15.1 and was already present in the v1.17.0 release that TuxCare onbo..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:43:00.051558+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 1.17.0 of axios. not_affected \u2014 The target repository at version 1.17.0-tuxcare.3 (commit bbe0ce0b) is NOT AFFECTED by CVE-2026-42040. The vulnerable code pattern\u2014a charMap entry '%00': '\\x00' that reverses safe percent-encoding of null bytes\u2014is not present in the target. The fix was already included in upstream axios version 1.15.1 (commit 5266af94, authored by Jay on 2026-04-16) and was incorporated...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 The target repository at version 1.17.0-tuxcare.3 (commit bbe0ce0b) is NOT AFFECTED by CVE-2026-42040. The vulnerable code pattern\u2014a charMap entry '%00': '\\x00' that reverses safe percent-encoding of null bytes\u2014is not present in the target. The fix was already included in upstream axios version 1.15.1 (commit 5266af94, authored by Jay on 2026-04-16) and was incorporated..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:41:00.055908+00:00", "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2026-42041 does not affect axios 1.17.0-tuxcare.3. The vulnerable code pattern (use of the `in` operator in `mergeDirectKeys` function) was replaced with safe own-property checks (`utils.hasOwnProp`) by upstream commit 42eb721e authored by jasonsaayman@gmail.com. This fix shipped in the upstream release before TuxCare maintenance began (first TuxCare commit: b3af74ee). The target's mergeCon...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42041" }, "impact_statement": "not_affected \u2014 CVE-2026-42041 does not affect axios 1.17.0-tuxcare.3. The vulnerable code pattern (use of the `in` operator in `mergeDirectKeys` function) was replaced with safe own-property checks (`utils.hasOwnProp`) by upstream commit 42eb721e authored by jasonsaayman@gmail.com. This fix shipped in the upstream release before TuxCare maintenance began (first TuxCare commit: b3af74ee). The target's mergeCon..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:51:00.043949+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.17.0 of axios. not_affected \u2014 The target axios 1.17.0-tuxcare.3 is NOT affected by CVE-2026-42042. The vulnerability (XSRF token cross-origin leakage via prototype pollution in withXSRFToken boolean coercion) has been fixed by an upstream commit that shipped in the upstream release. The code at lib/helpers/resolveConfig.js:102 uses strict boolean comparison (withXSRFToken === true) instead of truthy/falsy coercion, preventi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 The target axios 1.17.0-tuxcare.3 is NOT affected by CVE-2026-42042. The vulnerability (XSRF token cross-origin leakage via prototype pollution in withXSRFToken boolean coercion) has been fixed by an upstream commit that shipped in the upstream release. The code at lib/helpers/resolveConfig.js:102 uses strict boolean comparison (withXSRFToken === true) instead of truthy/falsy coercion, preventi..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:10:00.243861+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 1.17.0 of axios. not_affected \u2014 The target is NOT affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable pattern was removed by upstream axios commit 70302b6c9 authored by jasonsaayman@gmail.com, which shipped in axios 1.17.0 before TuxCare's backport work began. The fix replaced direct `this.parseReviver` access with `own(this, 'parseReviver')` that uses hasOwnProperty checks, preventing Object....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 The target is NOT affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable pattern was removed by upstream axios commit 70302b6c9 authored by jasonsaayman@gmail.com, which shipped in axios 1.17.0 before TuxCare's backport work began. The fix replaced direct `this.parseReviver` access with `own(this, 'parseReviver')` that uses hasOwnProperty checks, preventing Object...." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 1.17.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-04T12:54:00.070642+00:00", "status_notes": "Vulnerability CVE-2026-44489 does not affect version 1.17.0 of axios. not_affected \u2014 CVE-2026-44489 describes a prototype pollution bypass in Axios 1.15.2 where nested proxy object properties (proxy.username, proxy.password, proxy.auth.username) are read without hasOwnProperty checks, allowing injection of attacker-controlled credentials into Proxy-Authorization headers. The target repository (axios 1.17.0-tuxcare.3) is NOT AFFECTED because the upstream vendor already fixed thi...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44489" }, "impact_statement": "not_affected \u2014 CVE-2026-44489 describes a prototype pollution bypass in Axios 1.15.2 where nested proxy object properties (proxy.username, proxy.password, proxy.auth.username) are read without hasOwnProperty checks, allowing injection of attacker-controlled credentials into Proxy-Authorization headers. The target repository (axios 1.17.0-tuxcare.3) is NOT AFFECTED because the upstream vendor already fixed thi..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-06T11:41:35.274342+00:00", "status_notes": "Vulnerability CVE-2026-44490 does not affect version 1.17.0 of axios. not_affected \u2014 axios 1.17.0 already contains the upstream fix for CVE-2026-44490 (upstream commit 9d92bcd3, \"fix: gadgets and smaller issues (#10833)\"). Both gadgets are closed. merge() reads the accumulator through an own-property check. The defineProperty descriptors in mergeConfig, extend, AxiosError and AxiosHeaders use __proto__: null. The commit was authored and committed outside TuxCare and shipped in ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44490" }, "impact_statement": "not_affected \u2014 axios 1.17.0 already contains the upstream fix for CVE-2026-44490 (upstream commit 9d92bcd3, \"fix: gadgets and smaller issues (#10833)\"). Both gadgets are closed. merge() reads the accumulator through an own-property check. The defineProperty descriptors in mergeConfig, extend, AxiosError and AxiosHeaders use __proto__: null. The commit was authored and committed outside TuxCare and shipped in ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 1.17.0 of axios.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 1.17.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67312 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67312" }, "action_statement": "Vulnerability CVE-2026-67312 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67313 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67313" }, "action_statement": "Vulnerability CVE-2026-67313 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67315 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67315" }, "action_statement": "Vulnerability CVE-2026-67315 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67317 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67317" }, "action_statement": "Vulnerability CVE-2026-67317 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67318 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67318" }, "action_statement": "Vulnerability CVE-2026-67318 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-19T16:59:00.160917+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-16T08:30:14.662299+00:00", "status_notes": "Vulnerability CVE-2026-67321 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2.", "vulnerability": { "name": "CVE-2026-67321" }, "action_statement": "Vulnerability CVE-2026-67321 affects version 1.17.0 of axios, and is fixed in 1.17.0-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.17.0", "identifiers": { "purl": "pkg:npm/axios@1.17.0" } } ], "timestamp": "2026-10-26T14:00:26.903551+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.17.0.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." } ] }