{ "@id": "urn:uuid:db376504-d9e9-4942-8f47-a961ea359ff6", "role": "Document Creator", "author": "https://tuxcare.com", "version": 32, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:35:45.203613+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T11:18:00.104165+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.19.0 of axios. not_affected \u2014 The target (axios 1.19.0-tuxcare.1) is NOT AFFECTED by CVE-2020-28168 (SSRF via proxy bypass on redirect). The upstream fix commit c7329fef by Daniel Lopretto was already present in the release before TuxCare's first commit (554f3ccf). The fix installs a beforeRedirects.proxy callback (lib/adapters/http.js:408-420) that re-applies proxy configuration to every redirect request, preventing direct...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 The target (axios 1.19.0-tuxcare.1) is NOT AFFECTED by CVE-2020-28168 (SSRF via proxy bypass on redirect). The upstream fix commit c7329fef by Daniel Lopretto was already present in the release before TuxCare's first commit (554f3ccf). The fix installs a beforeRedirects.proxy callback (lib/adapters/http.js:408-420) that re-applies proxy configuration to every redirect request, preventing direct..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T11:32:00.041551+00:00", "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.19.0 of axios. not_affected \u2014 Target axios 1.19.0-tuxcare.1 is not affected by CVE-2023-45857. The vulnerability (XSRF token disclosure to cross-origin hosts via withCredentials condition) was fixed by upstream vendor in commit 96ee232bd3ee4de2e657333d4d2191cd389e14d0, which shipped in the upstream release before TuxCare's first commit. The vulnerable pattern is absent from the codebase.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45857" }, "impact_statement": "not_affected \u2014 Target axios 1.19.0-tuxcare.1 is not affected by CVE-2023-45857. The vulnerability (XSRF token disclosure to cross-origin hosts via withCredentials condition) was fixed by upstream vendor in commit 96ee232bd3ee4de2e657333d4d2191cd389e14d0, which shipped in the upstream release before TuxCare's first commit. The vulnerable pattern is absent from the codebase." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 1.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.19.0.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:01:31.786685+00:00", "status_notes": "Vulnerability CVE-2025-62718 does not affect version 1.19.0 of axios. not_affected \u2014 The target axios 1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2025-62718. The upstream fix (commit fb3befb6) for hostname normalization in NO_PROXY matching was already included in the upstream v1.19.0 release that TuxCare onboarded. The vulnerable code pattern (literal string comparison without normalization) is not present; the target contains the shouldBypassProxy helper with normalizeNoProxyHost...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2025-62718" }, "impact_statement": "not_affected \u2014 The target axios 1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2025-62718. The upstream fix (commit fb3befb6) for hostname normalization in NO_PROXY matching was already included in the upstream v1.19.0 release that TuxCare onboarded. The vulnerable code pattern (literal string comparison without normalization) is not present; the target contains the shouldBypassProxy helper with normalizeNoProxyHost..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101908 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101908" }, "action_statement": "Vulnerability CVE-2026-101908 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-10-20T09:36:00.146787+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 1.19.0 of axios, and is fixed in 1.19.0-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T11:59:00.062955+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.19.0 of axios. not_affected \u2014 The target axios 1.19.0-tuxcare.1 is not affected by CVE-2026-39865. The HTTP/2 session cleanup array iteration vulnerability was fixed by upstream commit 12c314b6 (Nov 4, 2025) authored by Dmitriy Mozgovoy . This fix shipped in the upstream release that TuxCare onboarded, prior to any TuxCare-authored commits in the branch history. The vulnerable pattern (continued iterat...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 The target axios 1.19.0-tuxcare.1 is not affected by CVE-2026-39865. The HTTP/2 session cleanup array iteration vulnerability was fixed by upstream commit 12c314b6 (Nov 4, 2025) authored by Dmitriy Mozgovoy . This fix shipped in the upstream release that TuxCare onboarded, prior to any TuxCare-authored commits in the branch history. The vulnerable pattern (continued iterat..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:05:15.358725+00:00", "status_notes": "Vulnerability CVE-2026-40175 does not affect version 1.19.0 of axios. not_affected \u2014 Target axios@1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2026-40175. The vulnerability (HTTP header injection via unsanitized CRLF in header values) was fixed in upstream commit cabead53 (May 6, 2026) which introduced sanitizeHeaderValue.js. This fix strips CRLF and other C0 control characters from header values using regex [\\u0000-\\u0008\\u000a-\\u001f\\u007f]+, preventing header injection attacks. T...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-40175" }, "impact_statement": "not_affected \u2014 Target axios@1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2026-40175. The vulnerability (HTTP header injection via unsanitized CRLF in header values) was fixed in upstream commit cabead53 (May 6, 2026) which introduced sanitizeHeaderValue.js. This fix strips CRLF and other C0 control characters from header values using regex [\\u0000-\\u0008\\u000a-\\u001f\\u007f]+, preventing header injection attacks. T..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:23:00.154087+00:00", "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.19.0 of axios. not_affected \u2014 CVE-2026-42034 is not present in axios 1.19.0-tuxcare.1. The vulnerability described a bypass of maxBodyLength enforcement for stream request bodies when maxRedirects=0, allowing oversized uploads. The target contains the upstream fix at lib/adapters/http.js:1426-1454, which wraps stream uploads in a byte-counting Transform that enforces maxBodyLength when transportEnforcesMaxBodyLength is fals...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42034" }, "impact_statement": "not_affected \u2014 CVE-2026-42034 is not present in axios 1.19.0-tuxcare.1. The vulnerability described a bypass of maxBodyLength enforcement for stream request bodies when maxRedirects=0, allowing oversized uploads. The target contains the upstream fix at lib/adapters/http.js:1426-1454, which wraps stream uploads in a byte-counting Transform that enforces maxBodyLength when transportEnforcesMaxBodyLength is fals..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:39:42.740503+00:00", "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.19.0 of axios. not_affected \u2014 CVE-2026-42036 describes a vulnerability where axios with responseType: 'stream' bypasses maxContentLength enforcement, allowing unbounded response consumption. The target repository (axios 1.19.0-tuxcare.1) contains the complete upstream fix at lib/adapters/http.js:1200-1226. When responseType === 'stream' and maxContentLength > -1, an async generator wraps the response stream, tracks cumulati...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42036" }, "impact_statement": "not_affected \u2014 CVE-2026-42036 describes a vulnerability where axios with responseType: 'stream' bypasses maxContentLength enforcement, allowing unbounded response consumption. The target repository (axios 1.19.0-tuxcare.1) contains the complete upstream fix at lib/adapters/http.js:1200-1226. When responseType === 'stream' and maxContentLength > -1, an async generator wraps the response stream, tracks cumulati..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:18:00.086689+00:00", "status_notes": "Vulnerability CVE-2026-42037 does not affect version 1.19.0 of axios. not_affected \u2014 CVE-2026-42037 (CRLF injection in multipart form-data) is NOT present in axios 1.19.0-tuxcare.1. The vulnerable code pattern (unsanitized value.type interpolation into Content-Type header) was fixed by upstream axios maintainer Jay (jasonsaayman@gmail.com) in commit 75873270 (\"fix: strip crlf correctly\", April 19, 2026). This fix shipped in the upstream 1.19.0 release that TuxCare onboarded, pr...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42037" }, "impact_statement": "not_affected \u2014 CVE-2026-42037 (CRLF injection in multipart form-data) is NOT present in axios 1.19.0-tuxcare.1. The vulnerable code pattern (unsanitized value.type interpolation into Content-Type header) was fixed by upstream axios maintainer Jay (jasonsaayman@gmail.com) in commit 75873270 (\"fix: strip crlf correctly\", April 19, 2026). This fix shipped in the upstream 1.19.0 release that TuxCare onboarded, pr..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:28:00.116656+00:00", "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.19.0 of axios. not_affected \u2014 The target (axios 1.19.0-tuxcare.1) is NOT affected by CVE-2026-42038. The loopback equivalence fix is already present in lib/helpers/shouldBypassProxy.js at line 503: `return hostname === entryHost || (isLoopback(hostname) && isLoopback(entryHost));`. This fix was shipped in the upstream axios 1.19.0 release (commit 163da7226 by jasonsaayman@gmail.com) before TuxCare onboarding, making this an...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42038" }, "impact_statement": "not_affected \u2014 The target (axios 1.19.0-tuxcare.1) is NOT affected by CVE-2026-42038. The loopback equivalence fix is already present in lib/helpers/shouldBypassProxy.js at line 503: `return hostname === entryHost || (isLoopback(hostname) && isLoopback(entryHost));`. This fix was shipped in the upstream axios 1.19.0 release (commit 163da7226 by jasonsaayman@gmail.com) before TuxCare onboarding, making this an..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:20:00.069930+00:00", "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.19.0 of axios. not_affected \u2014 Target axios 1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2026-42039. The vulnerability (unbounded recursion in toFormData causing stack overflow) was fixed by the upstream axios vendor in commit 85132ffba1a77609ea5d101c8a413dea7174932f. This fix was already present in the upstream release 1.19.0 that TuxCare onboarded, making the vulnerable pattern absent from the target. The fix adds a depth count...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42039" }, "impact_statement": "not_affected \u2014 Target axios 1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2026-42039. The vulnerability (unbounded recursion in toFormData causing stack overflow) was fixed by the upstream axios vendor in commit 85132ffba1a77609ea5d101c8a413dea7174932f. This fix was already present in the upstream release 1.19.0 that TuxCare onboarded, making the vulnerable pattern absent from the target. The fix adds a depth count..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:46:43.384430+00:00", "status_notes": "Vulnerability CVE-2026-42040 does not affect version 1.19.0 of axios. not_affected \u2014 CVE-2026-42040 describes a null byte injection vulnerability in the encode() function of lib/helpers/AxiosURLSearchParams.js, where a charMap entry '%00': '\\x00' reverses the safe percent-encoding of null bytes. The target repository (axios 1.19.0-tuxcare.1) does NOT contain this vulnerable pattern. The fix was applied by upstream developer Jay (jasonsaayman@gmail.com) in commit 5266af94 on 202...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42040" }, "impact_statement": "not_affected \u2014 CVE-2026-42040 describes a null byte injection vulnerability in the encode() function of lib/helpers/AxiosURLSearchParams.js, where a charMap entry '%00': '\\x00' reverses the safe percent-encoding of null bytes. The target repository (axios 1.19.0-tuxcare.1) does NOT contain this vulnerable pattern. The fix was applied by upstream developer Jay (jasonsaayman@gmail.com) in commit 5266af94 on 202..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:43:41.632918+00:00", "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.19.0 of axios. not_affected \u2014 CVE-2026-42041 (Prototype Pollution Gadget in validateStatus merge) is NOT present in axios v1.19.0. The vulnerable pattern (using `in` operator in mergeDirectKeys function) was already fixed by upstream commit 42eb721 authored by jasonsaayman@gmail.com, which replaced `in` with `utils.hasOwnProp()` to prevent prototype chain traversal. This fix was included in the upstream release v1.19.0 that...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42041" }, "impact_statement": "not_affected \u2014 CVE-2026-42041 (Prototype Pollution Gadget in validateStatus merge) is NOT present in axios v1.19.0. The vulnerable pattern (using `in` operator in mergeDirectKeys function) was already fixed by upstream commit 42eb721 authored by jasonsaayman@gmail.com, which replaced `in` with `utils.hasOwnProp()` to prevent prototype chain traversal. This fix was included in the upstream release v1.19.0 that..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:51:00.043949+00:00", "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.19.0 of axios. not_affected \u2014 The target axios 1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2026-42042. The vulnerable truthy/falsy evaluation pattern for withXSRFToken has been replaced with strict boolean checking (=== true, == null) that prevents prototype pollution gadgets and misconfigurations from leaking XSRF tokens cross-origin. This fix was authored by upstream axios maintainer jasonsaayman@gmail.com and shipped in the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42042" }, "impact_statement": "not_affected \u2014 The target axios 1.19.0-tuxcare.1 is NOT AFFECTED by CVE-2026-42042. The vulnerable truthy/falsy evaluation pattern for withXSRFToken has been replaced with strict boolean checking (=== true, == null) that prevents prototype pollution gadgets and misconfigurations from leaking XSRF tokens cross-origin. This fix was authored by upstream axios maintainer jasonsaayman@gmail.com and shipped in the ..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:11:00.125369+00:00", "status_notes": "Vulnerability CVE-2026-42044 does not affect version 1.19.0 of axios. not_affected \u2014 The target axios v1.19.0 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerability was fixed by upstream axios maintainer Jason Saayman in commits 70302b6c and 47915144, which shipped in the upstream v1.19.0 release before TuxCare onboarding. The fix includes: (1) using own() helper to safely read parseReviver with hasOwnProperty check at lib/defaults/index....", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-42044" }, "impact_statement": "not_affected \u2014 The target axios v1.19.0 is not affected by CVE-2026-42044 (parseReviver prototype pollution gadget). The vulnerability was fixed by upstream axios maintainer Jason Saayman in commits 70302b6c and 47915144, which shipped in the upstream v1.19.0 release before TuxCare onboarding. The fix includes: (1) using own() helper to safely read parseReviver with hasOwnProperty check at lib/defaults/index...." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 1.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 1.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 1.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-04T12:53:00.069359+00:00", "status_notes": "Vulnerability CVE-2026-44489 does not affect version 1.19.0 of axios. not_affected \u2014 The target version 1.19.0-tuxcare.1 is NOT affected by CVE-2026-44489. The vulnerability pattern (reading proxy properties from Object.prototype via unguarded property access in merge() and setProxy()) is not present in the target. The upstream fix (commit 9d92bcd3 from axios v1.16.0, May 2026) was already included in the upstream release before TuxCare onboarded this version. Both attack vecto...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44489" }, "impact_statement": "not_affected \u2014 The target version 1.19.0-tuxcare.1 is NOT affected by CVE-2026-44489. The vulnerability pattern (reading proxy properties from Object.prototype via unguarded property access in merge() and setProxy()) is not present in the target. The upstream fix (commit 9d92bcd3 from axios v1.16.0, May 2026) was already included in the upstream release before TuxCare onboarded this version. Both attack vecto..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T11:44:32.117699+00:00", "status_notes": "Vulnerability CVE-2026-44490 does not affect version 1.19.0 of axios. not_affected \u2014 Both CVE-2026-44490 gadgets are already fixed in the axios 1.19.0 base. utils.merge() reads its accumulator only through an own-property check, and every Object.defineProperty descriptor in lib/ uses __proto__: null. The fix is upstream commit 9d92bcd3 (jasonsaayman@gmail.com), which is in the upstream release before the first TuxCare commit.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-44490" }, "impact_statement": "not_affected \u2014 Both CVE-2026-44490 gadgets are already fixed in the axios 1.19.0 base. utils.merge() reads its accumulator only through an own-property check, and every Object.defineProperty descriptor in lib/ uses __proto__: null. The fix is upstream commit 9d92bcd3 (jasonsaayman@gmail.com), which is in the upstream release before the first TuxCare commit." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 1.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 1.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 1.19.0 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T22:33:41.905405+00:00", "status_notes": "Vulnerability CVE-2026-67312 does not affect version 1.19.0 of axios. not_affected \u2014 The target axios 1.19.0-tuxcare.1 is NOT vulnerable to CVE-2026-67312. The vulnerability (uncontrolled recursion in formDataToJSON causing call stack exhaustion) was fixed in upstream axios 1.18.0 via commit 32fc489632377d214db55bfa4e2c48486a7d7ce2 authored by jasonsaayman@gmail.com. The target is based on upstream 1.19.0, which already includes this fix. The vulnerable code pattern is not pres...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67312" }, "impact_statement": "not_affected \u2014 The target axios 1.19.0-tuxcare.1 is NOT vulnerable to CVE-2026-67312. The vulnerability (uncontrolled recursion in formDataToJSON causing call stack exhaustion) was fixed in upstream axios 1.18.0 via commit 32fc489632377d214db55bfa4e2c48486a7d7ce2 authored by jasonsaayman@gmail.com. The target is based on upstream 1.19.0, which already includes this fix. The vulnerable code pattern is not pres..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T21:12:32.411493+00:00", "status_notes": "Vulnerability CVE-2026-67313 does not affect version 1.19.0 of axios. not_affected \u2014 Target axios 1.19.0-tuxcare.1 already has the upstream depth guard in formDataToJSON (CVE-2026-67313). It shipped in the upstream 1.19.0 release via upstream commit 32fc4896, authored by jasonsaayman@gmail.com. buildPath and parsePropPath both reject nesting deeper than 100 with AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED, so unbounded recursion cannot occur. The proxy-bypass \"original report\" in t...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67313" }, "impact_statement": "not_affected \u2014 Target axios 1.19.0-tuxcare.1 already has the upstream depth guard in formDataToJSON (CVE-2026-67313). It shipped in the upstream 1.19.0 release via upstream commit 32fc4896, authored by jasonsaayman@gmail.com. buildPath and parsePropPath both reject nesting deeper than 100 with AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED, so unbounded recursion cannot occur. The proxy-bypass \"original report\" in t..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T21:10:00.052557+00:00", "status_notes": "Vulnerability CVE-2026-67314 does not affect version 1.19.0 of axios. not_affected \u2014 Not affected. The target (axios 1.19.0-tuxcare.1) already reads Basic-auth subfields through utils.getSafeProp, which ignores values reachable only via a polluted Object.prototype. This covers lib/adapters/http.js, lib/adapters/fetch.js and lib/helpers/resolveConfig.js. The hardening came with upstream commit 32fc4896 (the commit named in the patch URL, by an upstream author), which predates th...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67314" }, "impact_statement": "not_affected \u2014 Not affected. The target (axios 1.19.0-tuxcare.1) already reads Basic-auth subfields through utils.getSafeProp, which ignores values reachable only via a polluted Object.prototype. This covers lib/adapters/http.js, lib/adapters/fetch.js and lib/helpers/resolveConfig.js. The hardening came with upstream commit 32fc4896 (the commit named in the patch URL, by an upstream author), which predates th..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T21:27:46.185052+00:00", "status_notes": "Vulnerability CVE-2026-67315 does not affect version 1.19.0 of axios. not_affected \u2014 The target (axios 1.19.0-tuxcare.1) already treats 0.0.0.0 as loopback-equivalent in NO_PROXY matching. Upstream commit 32fc4896 (\"fix: malformed http urls (#11000)\") added '0.0.0.0' to LOOPBACK_HOSTNAMES and added IPv6 unspecified handling. It was authored by upstream (jasonsaayman@gmail.com, committed by noreply@github.com) and is already in the upstream release TuxCare onboarded, before the ...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67315" }, "impact_statement": "not_affected \u2014 The target (axios 1.19.0-tuxcare.1) already treats 0.0.0.0 as loopback-equivalent in NO_PROXY matching. Upstream commit 32fc4896 (\"fix: malformed http urls (#11000)\") added '0.0.0.0' to LOOPBACK_HOSTNAMES and added IPv6 unspecified handling. It was authored by upstream (jasonsaayman@gmail.com, committed by noreply@github.com) and is already in the upstream release TuxCare onboarded, before the ..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T12:38:00.046326+00:00", "status_notes": "Vulnerability CVE-2026-67316 does not affect version 1.19.0 of axios. not_affected \u2014 Axios 1.19.0-tuxcare.1 already reads data, proxy and paramsSerializer only as own properties, so polluted Object.prototype values do not reach the request. The fix is upstream commit 32fc489 (jasonsaayman@gmail.com), which is in the upstream release, so the verdict is not_affected with no TuxCare attribution.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67316" }, "impact_statement": "not_affected \u2014 Axios 1.19.0-tuxcare.1 already reads data, proxy and paramsSerializer only as own properties, so polluted Object.prototype values do not reach the request. The fix is upstream commit 32fc489 (jasonsaayman@gmail.com), which is in the upstream release, so the verdict is not_affected with no TuxCare attribution." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T21:15:07.675710+00:00", "status_notes": "Vulnerability CVE-2026-67317 does not affect version 1.19.0 of axios. not_affected \u2014 The fetch adapter in this target already enforces maxBodyLength on unknown-length ReadableStream request bodies. The fix is upstream commit 32fc4896 (author jasonsaayman@gmail.com, committer GitHub noreply). It is an ancestor of HEAD and sits below the first TuxCare commit (554f3ccf), so it shipped in the upstream release. It is an upstream fix, not a TuxCare backport.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67317" }, "impact_statement": "not_affected \u2014 The fetch adapter in this target already enforces maxBodyLength on unknown-length ReadableStream request bodies. The fix is upstream commit 32fc4896 (author jasonsaayman@gmail.com, committer GitHub noreply). It is an ancestor of HEAD and sits below the first TuxCare commit (554f3ccf), so it shipped in the upstream release. It is an upstream fix, not a TuxCare backport." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T21:24:00.067475+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 1.19.0 of axios. not_affected \u2014 The fix is already in the target. lib/adapters/http.js enforces maxBodyLength with a byte-counting pipeline for streamed uploads on every transport except follow-redirects, so HTTP/2 streams are capped. The fix is upstream commit 32fc4896, which is in the upstream release that TuxCare onboarded.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 The fix is already in the target. lib/adapters/http.js enforces maxBodyLength with a byte-counting pipeline for streamed uploads on every transport except follow-redirects, so HTTP/2 streams are capped. The fix is upstream commit 32fc4896, which is in the upstream release that TuxCare onboarded." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T12:38:58.250579+00:00", "status_notes": "Vulnerability CVE-2026-67319 does not affect version 1.19.0 of axios. not_affected \u2014 The axios 1.19.0-tuxcare.1 target already contains the upstream fix for the nested-option prototype-pollution gadget (upstream commit 32fc4896, \"fix: malformed http urls (#11000)\"). Every sink named in the CVE reads nested `auth` and `paramsSerializer` fields through `utils.getSafeProp`, which ignores values that exist only on a polluted Object.prototype. The fix was in the upstream release bef...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67319" }, "impact_statement": "not_affected \u2014 The axios 1.19.0-tuxcare.1 target already contains the upstream fix for the nested-option prototype-pollution gadget (upstream commit 32fc4896, \"fix: malformed http urls (#11000)\"). Every sink named in the CVE reads nested `auth` and `paramsSerializer` fields through `utils.getSafeProp`, which ignores values that exist only on a polluted Object.prototype. The fix was in the upstream release bef..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 1.19.0 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 1.19.0 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-06T21:35:45.203613+00:00", "status_notes": "Vulnerability CVE-2026-67321 does not affect version 1.19.0 of axios. not_affected \u2014 Not affected. The target (axios 1.19.0-tuxcare.1) already depth-limits the `{}` metatoken path in lib/helpers/toFormData.js. defaultVisitor calls stringifyWithDepthLimit(), which runs JSON.stringify with a replacer that tracks ancestors and throws AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED once depth exceeds maxDepth. That throw fires before native recursion can overflow the stack. The fix is an u...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-67321" }, "impact_statement": "not_affected \u2014 Not affected. The target (axios 1.19.0-tuxcare.1) already depth-limits the `{}` metatoken path in lib/helpers/toFormData.js. defaultVisitor calls stringifyWithDepthLimit(), which runs JSON.stringify with a replacer that tracks ancestors and throws AxiosError ERR_FORM_DATA_DEPTH_EXCEEDED once depth exceeds maxDepth. That throw fires before native recursion can overflow the stack. The fix is an u..." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.19.0", "identifiers": { "purl": "pkg:npm/axios@1.19.0" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.19.0.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." } ] }