{ "@id": "urn:uuid:d7dcedef-8f98-4813-9879-e02142882540", "role": "Document Creator", "author": "https://tuxcare.com", "version": 33, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:35:05.216685+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T11:15:10.917209+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios@1.18.1-tuxcare.2. The vulnerability allowed attackers to bypass proxy restrictions by providing a URL that redirected to a restricted host. The fix\u2014a `beforeRedirects.proxy` callback that re-applies proxy settings to every redirect\u2014is already present in the target (lib/adapters/http.js:419-431). This fix was shipped in t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios@1.18.1-tuxcare.2. The vulnerability allowed attackers to bypass proxy restrictions by providing a URL that redirected to a restricted host. The fix\u2014a `beforeRedirects.proxy` callback that re-applies proxy settings to every redirect\u2014is already present in the target (lib/adapters/http.js:419-431). This fix was shipped in t..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T11:33:00.090109+00:00", "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2023-45857 is not present in axios 1.18.1-tuxcare.2. The vulnerability (XSRF token leaked to cross-origin requests when withCredentials=true) was fixed in upstream commit 96ee232b by Valentin Panov, which shipped in the upstream v1.18.1 release that TuxCare onboarded. The fix restricts XSRF token transmission to same-origin requests only via a strict boolean check on withXSRFToken configura...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45857" }, "impact_statement": "not_affected \u2014 CVE-2023-45857 is not present in axios 1.18.1-tuxcare.2. The vulnerability (XSRF token leaked to cross-origin requests when withCredentials=true) was fixed in upstream commit 96ee232b by Valentin Panov, which shipped in the upstream v1.18.1 release that TuxCare onboarded. The fix restricts XSRF token transmission to same-origin requests only via a strict boolean check on withXSRFToken configura..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 1.18.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.18.1.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T11:59:00.062955+00:00", "status_notes": "Vulnerability CVE-2025-62718 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2025-62718 is NOT present in axios 1.18.1-tuxcare.2. The vulnerable pattern (literal string comparison of hostnames without normalization when checking NO_PROXY) was removed by upstream commit fb3befb6 authored by jasonsaayman@gmail.com, which shipped in the upstream release before TuxCare's involvement. The fix adds shouldBypassProxy() helper that normalizes hostnames by stripping trailing...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62718" }, "impact_statement": "not_affected \u2014 CVE-2025-62718 is NOT present in axios 1.18.1-tuxcare.2. The vulnerable pattern (literal string comparison of hostnames without normalization when checking NO_PROXY) was removed by upstream commit fb3befb6 authored by jasonsaayman@gmail.com, which shipped in the upstream release before TuxCare's involvement. The fix adds shouldBypassProxy() helper that normalizes hostnames by stripping trailing..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-16T23:26:00.085866+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-16T23:26:00.085866+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.2.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-10-01T11:25:42.944453+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 1.18.1 of axios, and is fixed in 1.18.1-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T11:49:56.996971+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-39865 describes a session cleanup vulnerability in axios HTTP/2 handling that allows process crashes through concurrent session closures. The target repository (axios 1.18.1-tuxcare.2) is NOT AFFECTED because the vulnerable pattern was already fixed in the upstream release. The fix was applied in commit 12c314b603e7852a157e93e47edb626a471ba6c5 (authored by robotshara@gmail.com, Nov 4, ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 CVE-2026-39865 describes a session cleanup vulnerability in axios HTTP/2 handling that allows process crashes through concurrent session closures. The target repository (axios 1.18.1-tuxcare.2) is NOT AFFECTED because the vulnerable pattern was already fixed in the upstream release. The fix was applied in commit 12c314b603e7852a157e93e47edb626a471ba6c5 (authored by robotshara@gmail.com, Nov 4, ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:06:46.180683+00:00", "status_notes": "Vulnerability CVE-2026-40175 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-40175 (CRLF injection in headers enabling request smuggling) is not present in axios 1.18.1. The upstream fix was shipped in the release before TuxCare onboarded. Commit cabead53 (authored by r.salhab@aiyexpertsolutions.com on May 6, 2026) added sanitizeHeaderValue helper that strips control characters including \\r and \\n from all header values, preventing CRLF injection attacks even w...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40175" }, "impact_statement": "not_affected \u2014 CVE-2026-40175 (CRLF injection in headers enabling request smuggling) is not present in axios 1.18.1. The upstream fix was shipped in the release before TuxCare onboarded. Commit cabead53 (authored by r.salhab@aiyexpertsolutions.com on May 6, 2026) added sanitizeHeaderValue helper that strips control characters including \\r and \\n from all header values, preventing CRLF injection attacks even w..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:17:42.127043+00:00", "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-42034 is not present in axios v1.18.1-tuxcare.2. The vulnerability (maxBodyLength bypass for streamed uploads when maxRedirects === 0) was fixed by upstream commit 1c7f6d76e58359daddf38a6e636dd801ffd9c61b, which shipped in the upstream release before TuxCare's involvement. The fix wraps upload streams in a byte-counting Transform that enforces maxBodyLength limits, preventing oversized...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42034" }, "impact_statement": "not_affected \u2014 CVE-2026-42034 is not present in axios v1.18.1-tuxcare.2. The vulnerability (maxBodyLength bypass for streamed uploads when maxRedirects === 0) was fixed by upstream commit 1c7f6d76e58359daddf38a6e636dd801ffd9c61b, which shipped in the upstream release before TuxCare's involvement. The fix wraps upload streams in a byte-counting Transform that enforces maxBodyLength limits, preventing oversized..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:32:36.937135+00:00", "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-42036: The vulnerable pattern (stream responses bypassing maxContentLength) is NOT present in axios 1.18.1-tuxcare.2. The upstream fix (commit e8904af03) was already included in the upstream release that TuxCare onboarded. The target code contains the complete enforcement logic at lib/adapters/http.js:1211-1237, which wraps stream responses in an async generator that tracks cumulative ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42036" }, "impact_statement": "not_affected \u2014 CVE-2026-42036: The vulnerable pattern (stream responses bypassing maxContentLength) is NOT present in axios 1.18.1-tuxcare.2. The upstream fix (commit e8904af03) was already included in the upstream release that TuxCare onboarded. The target code contains the complete enforcement logic at lib/adapters/http.js:1211-1237, which wraps stream responses in an async generator that tracks cumulative ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:14:00.061372+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-42037 (CRLF injection in FormData multipart headers) is not present in axios v1.18.1-tuxcare.2. The upstream fix by Jay (jasonsaayman@gmail.com) from commit 75873270a shipped in the release before TuxCare began maintaining this branch. The fix at lib/helpers/formDataToStream.js:27 strips all \\r and \\n characters from value.type before interpolating it into Content-Type headers, prevent...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 CVE-2026-42037 (CRLF injection in FormData multipart headers) is not present in axios v1.18.1-tuxcare.2. The upstream fix by Jay (jasonsaayman@gmail.com) from commit 75873270a shipped in the release before TuxCare began maintaining this branch. The fix at lib/helpers/formDataToStream.js:27 strips all \\r and \\n characters from value.type before interpolating it into Content-Type headers, prevent..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:29:00.234144+00:00", "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-42038 describes an incomplete fix for no_proxy hostname normalization where setting no_proxy=localhost does not block requests to 127.0.0.1 or [::1] due to pure string matching without loopback alias resolution. The target repository contains the upstream fix (commit 163da722 by Jay) that adds loopback equivalence checking. This fix was already present in the upstream release (axios 1....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42038" }, "impact_statement": "not_affected \u2014 CVE-2026-42038 describes an incomplete fix for no_proxy hostname normalization where setting no_proxy=localhost does not block requests to 127.0.0.1 or [::1] due to pure string matching without loopback alias resolution. The target repository contains the upstream fix (commit 163da722 by Jay) that adds loopback equivalence checking. This fix was already present in the upstream release (axios 1...." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:19:00.089013+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-42039 is NOT present in axios 1.18.1-tuxcare.2. The vulnerability (unbounded recursion in toFormData causing stack overflow) was fixed in upstream commit 85132ffba1a77609ea5d101c8a413dea7174932f by Jay (jasonsaayman@gmail.com) on 2026-04-15. This fix shipped in the upstream release that TuxCare onboarded, before any TuxCare-authored commits were applied to this version branch. The targ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 CVE-2026-42039 is NOT present in axios 1.18.1-tuxcare.2. The vulnerability (unbounded recursion in toFormData causing stack overflow) was fixed in upstream commit 85132ffba1a77609ea5d101c8a413dea7174932f by Jay (jasonsaayman@gmail.com) on 2026-04-15. This fix shipped in the upstream release that TuxCare onboarded, before any TuxCare-authored commits were applied to this version branch. The targ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:43:14.798986+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 1.18.1 of axios. not_affected \u2014 The target repository (axios v1.18.1-tuxcare.2) does not contain the vulnerable null byte reverse-encoding pattern described in CVE-2026-42040. The vulnerable code (`'%00': '\\x00'` charMap entry in AxiosURLSearchParams.js) was removed by upstream commit 5266af94 authored by Jay and was already present in the upstream release before TuxCare began maintaining this version...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 The target repository (axios v1.18.1-tuxcare.2) does not contain the vulnerable null byte reverse-encoding pattern described in CVE-2026-42040. The vulnerable code (`'%00': '\\x00'` charMap entry in AxiosURLSearchParams.js) was removed by upstream commit 5266af94 authored by Jay and was already present in the upstream release before TuxCare began maintaining this version..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:46:58.973055+00:00", "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-42041 describes a prototype pollution gadget in axios where the mergeDirectKeys function used the `in` operator to check for the validateStatus property, allowing inheritance from a polluted Object.prototype.validateStatus. The target repository is NOT vulnerable because commit 42eb721e (authored by jasonsaayman@gmail.com on April 19, 2026) already replaced the vulnerable `in` operator...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42041" }, "impact_statement": "not_affected \u2014 CVE-2026-42041 describes a prototype pollution gadget in axios where the mergeDirectKeys function used the `in` operator to check for the validateStatus property, allowing inheritance from a polluted Object.prototype.validateStatus. The target repository is NOT vulnerable because commit 42eb721e (authored by jasonsaayman@gmail.com on April 19, 2026) already replaced the vulnerable `in` operator..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:41:00.055908+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.18.1 of axios. not_affected \u2014 CVE-2026-42042 is NOT present in axios 1.18.1-tuxcare.2. The vulnerable truthy/falsy coercion pattern has been replaced with strict boolean comparison (`withXSRFToken === true`) that prevents prototype pollution gadgets and misconfigurations from bypassing the same-origin check. The fix was introduced by upstream commit 1728aa1b (authored by Jay/jasonsaayman@gmail.com on 2026-04-19) and was alr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 CVE-2026-42042 is NOT present in axios 1.18.1-tuxcare.2. The vulnerable truthy/falsy coercion pattern has been replaced with strict boolean comparison (`withXSRFToken === true`) that prevents prototype pollution gadgets and misconfigurations from bypassing the same-origin check. The fix was introduced by upstream commit 1728aa1b (authored by Jay/jasonsaayman@gmail.com on 2026-04-19) and was alr..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:10:00.243861+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 1.18.1 of axios. not_affected \u2014 The target (axios v1.18.1-tuxcare.2) is NOT vulnerable to CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern described in the CVE \u2014 direct property access `JSON.parse(data, this.parseReviver)` allowing prototype-inherited functions \u2014 is not present. Upstream commit 70302b6c by jasonsaayman@gmail.com (April 18, 2026) introduced an `own()` helper that checks `ha...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 The target (axios v1.18.1-tuxcare.2) is NOT vulnerable to CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerable code pattern described in the CVE \u2014 direct property access `JSON.parse(data, this.parseReviver)` allowing prototype-inherited functions \u2014 is not present. Upstream commit 70302b6c by jasonsaayman@gmail.com (April 18, 2026) introduced an `own()` helper that checks `ha..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 1.18.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 1.18.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 1.18.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:54:00.070642+00:00", "status_notes": "Vulnerability CVE-2026-44489 does not affect version 1.18.1 of axios. not_affected \u2014 axios 1.18.1-tuxcare.2 is NOT AFFECTED by CVE-2026-44489 (Proxy-Authorization header injection via prototype pollution). The vulnerability pattern is not present because the upstream vendor (axios) shipped a complete fix in commit 9d92bcd3 (May 2, 2026) by maintainer Jason Saayman. This fix was included in upstream v1.16.0+ and is present in the v1.18.1 release that TuxCare onboarded. Both vuln...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44489" }, "impact_statement": "not_affected \u2014 axios 1.18.1-tuxcare.2 is NOT AFFECTED by CVE-2026-44489 (Proxy-Authorization header injection via prototype pollution). The vulnerability pattern is not present because the upstream vendor (axios) shipped a complete fix in commit 9d92bcd3 (May 2, 2026) by maintainer Jason Saayman. This fix was included in upstream v1.16.0+ and is present in the v1.18.1 release that TuxCare onboarded. Both vuln..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-04T12:54:00.070642+00:00", "status_notes": "Vulnerability CVE-2026-44490 does not affect version 1.18.1 of axios. not_affected \u2014 The target axios 1.18.1 is NOT AFFECTED by CVE-2026-44490. All three upstream fixes for the prototype pollution gadgets (null-prototype objects in mergeConfig, dangerous key filtering in utils.merge, and own-property checks in adapters/resolveConfig) were shipped in axios v1.15.2 and are present in the target. The vulnerable code patterns described in the CVE (plain {} objects allowing prototyp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44490" }, "impact_statement": "not_affected \u2014 The target axios 1.18.1 is NOT AFFECTED by CVE-2026-44490. All three upstream fixes for the prototype pollution gadgets (null-prototype objects in mergeConfig, dangerous key filtering in utils.merge, and own-property checks in adapters/resolveConfig) were shipped in axios v1.15.2 and are present in the target. The vulnerable code patterns described in the CVE (plain {} objects allowing prototyp..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 1.18.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 1.18.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 1.18.1 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T22:34:47.245933+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 1.18.1 of axios. not_affected \u2014 The target axios version 1.18.1-tuxcare.2 is NOT AFFECTED by CVE-2026-67312. The vulnerability (uncontrolled recursion in formDataToJSON when processing deeply nested FormData field names) was fixed in upstream axios v1.18.0 via commit 32fc489, which added depth checking (max 100 levels) to prevent stack exhaustion. The target version is based on upstream 1.18.1 and includes this fix. The vulne...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 The target axios version 1.18.1-tuxcare.2 is NOT AFFECTED by CVE-2026-67312. The vulnerability (uncontrolled recursion in formDataToJSON when processing deeply nested FormData field names) was fixed in upstream axios v1.18.0 via commit 32fc489, which added depth checking (max 100 levels) to prevent stack exhaustion. The target version is based on upstream 1.18.1 and includes this fix. The vulne..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T21:12:32.411493+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 1.18.1 of axios. not_affected \u2014 The depth guard from the upstream fix (commit 32fc4896, which matches one of the linked patches) is already in the target's lib/helpers/formDataToJSON.js. Deeply nested form field names are rejected with AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED before any deep recursion. The fix was shipped in the upstream release that TuxCare onboarded, so it is an upstream fix.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 The depth guard from the upstream fix (commit 32fc4896, which matches one of the linked patches) is already in the target's lib/helpers/formDataToJSON.js. Deeply nested form field names are rejected with AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED before any deep recursion. The fix was shipped in the upstream release that TuxCare onboarded, so it is an upstream fix." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T21:05:20.992930+00:00", "status_notes": "Vulnerability CVE-2026-67314 does not affect version 1.18.1 of axios. not_affected \u2014 Not affected. The target (axios 1.18.1) already contains the upstream fix. Every basic-auth subfield read uses utils.getSafeProp, which ignores values reachable only through a polluted Object.prototype. The fix shipped in the upstream release as commit 32fc4896 by Jay . That commit is an ancestor of HEAD and of the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67314" }, "impact_statement": "not_affected \u2014 Not affected. The target (axios 1.18.1) already contains the upstream fix. Every basic-auth subfield read uses utils.getSafeProp, which ignores values reachable only through a polluted Object.prototype. The fix shipped in the upstream release as commit 32fc4896 by Jay . That commit is an ancestor of HEAD and of the first TuxCare commit." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T21:24:36.806712+00:00", "status_notes": "Vulnerability CVE-2026-67315 does not affect version 1.18.1 of axios. not_affected \u2014 Target axios 1.18.1 already contains the upstream fix. lib/helpers/shouldBypassProxy.js treats 0.0.0.0 as loopback-equivalent (LOOPBACK_HOSTNAMES includes '0.0.0.0') and also handles the IPv6 unspecified forms. The fix is upstream commit 32fc4896 ('fix: malformed http urls (#11000)'). It is an ancestor of the first TuxCare commit, so it shipped in the upstream release and is not a TuxCare backp...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67315" }, "impact_statement": "not_affected \u2014 Target axios 1.18.1 already contains the upstream fix. lib/helpers/shouldBypassProxy.js treats 0.0.0.0 as loopback-equivalent (LOOPBACK_HOSTNAMES includes '0.0.0.0') and also handles the IPv6 unspecified forms. The fix is upstream commit 32fc4896 ('fix: malformed http urls (#11000)'). It is an ancestor of the first TuxCare commit, so it shipped in the upstream release and is not a TuxCare backp..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T12:38:08.563311+00:00", "status_notes": "Vulnerability CVE-2026-67316 does not affect version 1.18.1 of axios. not_affected \u2014 Axios 1.18.1 already contains the upstream fix for CVE-2026-67316. The bodyless aliases read `data` only through an own-property check. The Node HTTP adapter and `resolveConfig` read `proxy` and `paramsSerializer` through an own-property helper. The fix commit is upstream-authored and was already in the release TuxCare onboarded, so the verdict is not_affected.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67316" }, "impact_statement": "not_affected \u2014 Axios 1.18.1 already contains the upstream fix for CVE-2026-67316. The bodyless aliases read `data` only through an own-property check. The Node HTTP adapter and `resolveConfig` read `proxy` and `paramsSerializer` through an own-property helper. The fix commit is upstream-authored and was already in the release TuxCare onboarded, so the verdict is not_affected." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T21:15:07.675710+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 1.18.1 of axios. not_affected \u2014 The fetch adapter in this tree already enforces maxBodyLength for unknown-length ReadableStream bodies. The upstream commit 32fc4896 (jasonsaayman@gmail.com, committer noreply@github.com) adds the per-chunk byte counting. It is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream release and is not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 The fetch adapter in this tree already enforces maxBodyLength for unknown-length ReadableStream bodies. The upstream commit 32fc4896 (jasonsaayman@gmail.com, committer noreply@github.com) adds the per-chunk byte counting. It is an ancestor of HEAD and of the first TuxCare commit, so the fix shipped in the upstream release and is not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T21:20:00.118356+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 1.18.1 of axios. not_affected \u2014 The fix is already present in HEAD. Upstream commit 32fc4896 is in the upstream release that TuxCare onboarded. In lib/adapters/http.js the byte-counting stream wrapper now runs on every transport except follow-redirects, which enforces the limit itself. HTTP/2 uploads are therefore capped.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 The fix is already present in HEAD. Upstream commit 32fc4896 is in the upstream release that TuxCare onboarded. In lib/adapters/http.js the byte-counting stream wrapper now runs on every transport except follow-redirects, which enforces the limit itself. HTTP/2 uploads are therefore capped." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T12:38:43.867433+00:00", "status_notes": "Vulnerability CVE-2026-67319 does not affect version 1.18.1 of axios. not_affected \u2014 Not affected. The target is axios 1.18.1, which already reads auth.username, auth.password, paramsSerializer.encode and paramsSerializer.serialize through utils.getSafeProp. That helper ignores values that exist only on a polluted Object.prototype. The fix is upstream commit 32fc4896 (author jasonsaayman@gmail.com, \"fix: malformed http urls (#11000)\"). It predates the first TuxCare commit, so i...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67319" }, "impact_statement": "not_affected \u2014 Not affected. The target is axios 1.18.1, which already reads auth.username, auth.password, paramsSerializer.encode and paramsSerializer.serialize through utils.getSafeProp. That helper ignores values that exist only on a polluted Object.prototype. The fix is upstream commit 32fc4896 (author jasonsaayman@gmail.com, \"fix: malformed http urls (#11000)\"). It predates the first TuxCare commit, so i..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 1.18.1 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 1.18.1 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-06T21:35:05.216685+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 1.18.1 of axios. not_affected \u2014 The target already contains the upstream fix (axios commit 32fc4896, 'fix: malformed http urls (#11000)'). In lib/helpers/toFormData.js the top-level '{}'-suffixed key branch now calls stringifyWithDepthLimit(value, 1) instead of a bare JSON.stringify. A replacer throws ERR_FORM_DATA_DEPTH_EXCEEDED once depth exceeds maxDepth (default 100), before the native stringifier can recurse deeply. The ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 The target already contains the upstream fix (axios commit 32fc4896, 'fix: malformed http urls (#11000)'). In lib/helpers/toFormData.js the top-level '{}'-suffixed key branch now calls stringifyWithDepthLimit(value, 1) instead of a bare JSON.stringify. A replacer throws ERR_FORM_DATA_DEPTH_EXCEEDED once depth exceeds maxDepth (default 100), before the native stringifier can recurse deeply. The ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.18.1", "identifiers": { "purl": "pkg:npm/axios@1.18.1" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.18.1.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." } ] }