{
  "@id": "urn:uuid:ece37f88-5e92-46fa-97f2-6e4bf9a9092b",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 14,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T21:19:00.030345+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2019-10742 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2019-10742"
      },
      "action_statement": "Vulnerability CVE-2019-10742 affects version 1.6.8 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-04T11:09:00.152313+00:00",
      "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.6.8 of axios. not_affected \u2014 Target axios 1.6.8-tuxcare.5 is not affected by CVE-2020-28168 (SSRF via proxy bypass on redirects). The vulnerability pattern is not present because the upstream fix (commit c7329fef by Daniel Lopretto) was already included in the release when TuxCare onboarded version 1.6.8. The fix adds a beforeRedirect handler that re-applies proxy configuration to all redirect requests, preventing direct c...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28168"
      },
      "impact_statement": "not_affected \u2014 Target axios 1.6.8-tuxcare.5 is not affected by CVE-2020-28168 (SSRF via proxy bypass on redirects). The vulnerability pattern is not present because the upstream fix (commit c7329fef by Daniel Lopretto) was already included in the release when TuxCare onboarded version 1.6.8. The fix adds a beforeRedirect handler that re-applies proxy configuration to all redirect requests, preventing direct c..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2021-3749 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2021-3749"
      },
      "action_statement": "Vulnerability CVE-2021-3749 affects version 1.6.8 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-04T11:27:46.564169+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.6.8 of axios. not_affected \u2014 The target repository (axios 1.6.8-tuxcare.5) is NOT affected by CVE-2023-45857. The vulnerability involved XSRF tokens being leaked to cross-origin servers when withCredentials was true. The upstream fix (commit 96ee232b, part of axios v1.6.0) removed the vulnerable config.withCredentials condition, ensuring XSRF tokens are only sent to same-origin URLs by default. This fix was already present...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "impact_statement": "not_affected \u2014 The target repository (axios 1.6.8-tuxcare.5) is NOT affected by CVE-2023-45857. The vulnerability involved XSRF tokens being leaked to cross-origin servers when withCredentials was true. The upstream fix (commit 96ee232b, part of axios v1.6.0) removed the vulnerable config.withCredentials condition, ensuring XSRF tokens are only sent to same-origin URLs by default. This fix was already present..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2024-39338 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2024-39338"
      },
      "action_statement": "Vulnerability CVE-2024-39338 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 does not affect version 1.6.8 of axios. CVE-2025-27152 fix already exists in commit 22c2e77ccde46e0a3c0d1513b682eba8dfb41d75",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "impact_statement": "CVE-2025-27152 fix already exists in commit 22c2e77ccde46e0a3c0d1513b682eba8dfb41d75"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "CVE-2025-54371"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58754 does not affect version 1.6.8 of axios. CVE-2025-58754 fix already exists in commit fe89d8c609e567fa731f7677ab065742330f25ea",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-58754"
      },
      "impact_statement": "CVE-2025-58754 fix already exists in commit fe89d8c609e567fa731f7677ab065742330f25ea"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 does not affect version 1.6.8 of axios. CVE-2025-62718 fix already exists in commit dd333bdabf51d856d0d14fe7bd9d50ac817e4aa2",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "impact_statement": "CVE-2025-62718 fix already exists in commit dd333bdabf51d856d0d14fe7bd9d50ac817e4aa2"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101898 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101898"
      },
      "action_statement": "Vulnerability CVE-2026-101898 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101899 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101899"
      },
      "action_statement": "Vulnerability CVE-2026-101899 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101900 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101900"
      },
      "action_statement": "Vulnerability CVE-2026-101900 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101901 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101901"
      },
      "action_statement": "Vulnerability CVE-2026-101901 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-10-10T21:02:00.184075+00:00",
      "status_notes": "Vulnerability CVE-2026-101902 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-101902"
      },
      "action_statement": "Vulnerability CVE-2026-101902 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101903 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101903"
      },
      "action_statement": "Vulnerability CVE-2026-101903 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-10-10T21:02:00.184075+00:00",
      "status_notes": "Vulnerability CVE-2026-101904 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.5.",
      "vulnerability": {
        "name": "CVE-2026-101904"
      },
      "action_statement": "Vulnerability CVE-2026-101904 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101905 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101905"
      },
      "action_statement": "Vulnerability CVE-2026-101905 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101906 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101906"
      },
      "action_statement": "Vulnerability CVE-2026-101906 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101907 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101907"
      },
      "action_statement": "Vulnerability CVE-2026-101907 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101908 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101908"
      },
      "action_statement": "Vulnerability CVE-2026-101908 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101909 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101909"
      },
      "action_statement": "Vulnerability CVE-2026-101909 affects version 1.6.8 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 does not affect version 1.6.8 of axios. CVE-2026-25639 fix already exists in commit f4e3c49872deb794ae9a7bb71a8345ea2ec4b6eb",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "impact_statement": "CVE-2026-25639 fix already exists in commit f4e3c49872deb794ae9a7bb71a8345ea2ec4b6eb"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-04T11:49:00.031657+00:00",
      "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.6.8 of axios. not_affected \u2014 Target version 1.6.8 does not contain HTTP/2 support. The vulnerability exists in the Http2Sessions class session cleanup logic, which was introduced in axios version 1.13.2 (commit d676df77, October 2025). Version 1.6.8 predates this feature entirely and cannot receive HTTP/2 session close events. Exhaustive search confirmed no http2 imports, no Http2Sessions class, and no similar array-splice...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39865"
      },
      "impact_statement": "not_affected \u2014 Target version 1.6.8 does not contain HTTP/2 support. The vulnerability exists in the Http2Sessions class session cleanup logic, which was introduced in axios version 1.13.2 (commit d676df77, October 2025). Version 1.6.8 predates this feature entirely and cannot receive HTTP/2 session close events. Exhaustive search confirmed no http2 imports, no Http2Sessions class, and no similar array-splice..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 does not affect version 1.6.8 of axios. CVE-2026-40175 fix already exists in commit e3c915c5421c511d667ffeace65d8d65829e19e8",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "impact_statement": "CVE-2026-40175 fix already exists in commit e3c915c5421c511d667ffeace65d8d65829e19e8"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 does not affect version 1.6.8 of axios. CVE-2026-42033 fix already exists in commit 9c513d377d64d936e51eb33b901bb6a26258abd8",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "impact_statement": "CVE-2026-42033 fix already exists in commit 9c513d377d64d936e51eb33b901bb6a26258abd8"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 does not affect version 1.6.8 of axios. CVE-2026-42034 fix already exists in commit cd256b069536974eeec07e8047ceeb87986d19bc",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "impact_statement": "CVE-2026-42034 fix already exists in commit cd256b069536974eeec07e8047ceeb87986d19bc"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 does not affect version 1.6.8 of axios. CVE-2026-42035 fix already exists in commit b9e4e1b49f5f62215e46c059f343b2e9ccb81c39",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "impact_statement": "CVE-2026-42035 fix already exists in commit b9e4e1b49f5f62215e46c059f343b2e9ccb81c39"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 does not affect version 1.6.8 of axios. CVE-2026-42036 fix already exists in commit db7082ebbf0cf245e8d001407b789a154606afac",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "impact_statement": "CVE-2026-42036 fix already exists in commit db7082ebbf0cf245e8d001407b789a154606afac"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42037 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42037"
      },
      "action_statement": "Vulnerability CVE-2026-42037 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 does not affect version 1.6.8 of axios. CVE-2026-42038 fix already exists in commit 38fbaef2676858fc97ea981cf9e2fabf343e60a4",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "impact_statement": "CVE-2026-42038 fix already exists in commit 38fbaef2676858fc97ea981cf9e2fabf343e60a4"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 does not affect version 1.6.8 of axios. CVE-2026-42039 fix already exists in commit da36cba07a133fa5f833556303db0e3e5ce3dc87",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "impact_statement": "CVE-2026-42039 fix already exists in commit da36cba07a133fa5f833556303db0e3e5ce3dc87"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "action_statement": "Vulnerability CVE-2026-42040 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 does not affect version 1.6.8 of axios. CVE-2026-42041 fix already exists in commit 935b8c002f9b50ff36d4f0ed3b6be5fc855a0b6e",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "impact_statement": "CVE-2026-42041 fix already exists in commit 935b8c002f9b50ff36d4f0ed3b6be5fc855a0b6e"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 does not affect version 1.6.8 of axios. CVE-2026-42042 fix already exists in commit be54ef4e740e14b267e765f8e42ff9104d78bc8b",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "impact_statement": "CVE-2026-42042 fix already exists in commit be54ef4e740e14b267e765f8e42ff9104d78bc8b"
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 does not affect version 1.6.8 of axios. CVE-2026-42043 fix already exists in commit 2a6288f317a7bfc46a41088a3809a22e8193340a",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "impact_statement": "CVE-2026-42043 fix already exists in commit 2a6288f317a7bfc46a41088a3809a22e8193340a"
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42044 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42044"
      },
      "action_statement": "Vulnerability CVE-2026-42044 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42264 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-42264"
      },
      "action_statement": "Vulnerability CVE-2026-42264 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44488 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44488"
      },
      "action_statement": "Vulnerability CVE-2026-44488 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44489 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44489"
      },
      "action_statement": "Vulnerability CVE-2026-44489 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-44490"
      },
      "action_statement": "Vulnerability CVE-2026-44490 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 does not affect version 1.6.8 of axios. not_affected \u2014 axios v1.6.8 is not affected by CVE-2026-44492. The vulnerable code (lib/helpers/shouldBypassProxy.js) was introduced in v1.15.0, and v1.6.8 predates this entirely. The target uses a different architecture (proxy-from-env only) that is outside the scope of this CVE.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "impact_statement": "not_affected \u2014 axios v1.6.8 is not affected by CVE-2026-44492. The vulnerable code (lib/helpers/shouldBypassProxy.js) was introduced in v1.15.0, and v1.6.8 predates this entirely. The target uses a different architecture (proxy-from-env only) that is outside the scope of this CVE."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44494 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44494"
      },
      "action_statement": "Vulnerability CVE-2026-44494 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67312 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67312"
      },
      "action_statement": "Vulnerability CVE-2026-67312 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67313 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67313"
      },
      "action_statement": "Vulnerability CVE-2026-67313 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-67314 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67314"
      },
      "action_statement": "Vulnerability CVE-2026-67314 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67315 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67315"
      },
      "action_statement": "Vulnerability CVE-2026-67315 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-06T21:14:00.043521+00:00",
      "status_notes": "Vulnerability CVE-2026-67317 does not affect version 1.6.8 of axios. not_affected \u2014 Not affected. The vulnerable code, the axios fetch adapter (lib/adapters/fetch.js), does not exist in this 1.6.8-tuxcare.5 tree. The only adapters are http and xhr, and the CVE states that versions before the fetch adapter and the HTTP adapter's stream path are not affected.",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-67317"
      },
      "impact_statement": "not_affected \u2014 Not affected. The vulnerable code, the axios fetch adapter (lib/adapters/fetch.js), does not exist in this 1.6.8-tuxcare.5 tree. The only adapters are http and xhr, and the CVE states that versions before the fetch adapter and the HTTP adapter's stream path are not affected."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-06T21:19:00.030345+00:00",
      "status_notes": "Vulnerability CVE-2026-67318 does not affect version 1.6.8 of axios. not_affected \u2014 axios 1.6.8 (tuxcare) has no HTTP/2 transport at all, so the HTTP/2 bypass in this CVE cannot occur. Streamed uploads always go through follow-redirects, which enforces options.maxBodyLength, or through the byte-counting wrapper when maxRedirects is 0. Target is not affected.",
      "vulnerability": {
        "name": "CVE-2026-67318"
      },
      "impact_statement": "not_affected \u2014 axios 1.6.8 (tuxcare) has no HTTP/2 transport at all, so the HTTP/2 bypass in this CVE cannot occur. Streamed uploads always go through follow-redirects, which enforces options.maxBodyLength, or through the byte-counting wrapper when maxRedirects is 0. Target is not affected."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67320 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67320"
      },
      "action_statement": "Vulnerability CVE-2026-67320 affects version 1.6.8 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67321 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67321"
      },
      "action_statement": "Vulnerability CVE-2026-67321 affects version 1.6.8 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-38gx-cfqf-f652"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-39j5-w47m-2gmv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-3mcp-22mf-vrw3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "GHSA-42h9-826w-cgv3"
      },
      "action_statement": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.6.8 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-4ww2-rjh2-xpv9"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-68jp-44vc-2x5h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-6hqm-hm2v-3p2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "GHSA-7q8q-rj6j-mhjq"
      },
      "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.6.8 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-9wx3-p993-35vp"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-f2r5-pqh9-r8f8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-fq2j-3j99-rx65"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.6.8.",
      "vulnerability": {
        "name": "GHSA-fqj3-h9pc-443h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.3.",
      "vulnerability": {
        "name": "GHSA-mmx7-hfxf-jppx"
      },
      "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.6.8 of axios, and is fixed in 1.6.8-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.6.8",
          "identifiers": {
            "purl": "pkg:npm/axios@1.6.8"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.6.8 of axios.",
      "vulnerability": {
        "name": "GHSA-pmv8-rq9r-6j72"
      },
      "action_statement": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.6.8 of axios."
    }
  ]
}