{ "@id": "urn:uuid:6beb9ecb-239a-44fe-8f69-9a34e80e5646", "role": "Document Creator", "author": "https://tuxcare.com", "version": 14, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-11-06T21:15:07.675710+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2019-10742 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2019-10742" }, "action_statement": "Vulnerability CVE-2019-10742 affects version 1.7.5 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-04T11:13:00.100427+00:00", "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.7.5 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via redirect bypassing proxy) is NOT present in axios 1.7.5-tuxcare.6. The upstream fix (commit c7329fef) was already included in the upstream release before TuxCare onboarding. The target contains the defense mechanism: setProxy() installs a beforeRedirects.proxy callback (lib/adapters/http.js:172-176) that re-applies proxy configuration when following redirects, preventin...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2020-28168" }, "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via redirect bypassing proxy) is NOT present in axios 1.7.5-tuxcare.6. The upstream fix (commit c7329fef) was already included in the upstream release before TuxCare onboarding. The target contains the defense mechanism: setProxy() installs a beforeRedirects.proxy callback (lib/adapters/http.js:172-176) that re-applies proxy configuration when following redirects, preventin..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2021-3749 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2021-3749" }, "action_statement": "Vulnerability CVE-2021-3749 affects version 1.7.5 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-04T11:33:00.090109+00:00", "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.7.5 of axios. not_affected \u2014 CVE-2023-45857 describes a vulnerability where axios 0.8.1-1.5.1 inadvertently sends XSRF tokens to cross-origin hosts when withCredentials is true. The target version 1.7.5-tuxcare.6 is NOT affected because the upstream axios 1.7.x release (onboarded at commit 1e8ae7d5) already contained the fix. The vulnerable pattern (withCredentials bypassing same-origin checks) was removed in upstream comm...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2023-45857" }, "impact_statement": "not_affected \u2014 CVE-2023-45857 describes a vulnerability where axios 0.8.1-1.5.1 inadvertently sends XSRF tokens to cross-origin hosts when withCredentials is true. The target version 1.7.5-tuxcare.6 is NOT affected because the upstream axios 1.7.x release (onboarded at commit 1e8ae7d5) already contained the fix. The vulnerable pattern (withCredentials bypassing same-origin checks) was removed in upstream comm..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2024-39338 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2024-39338" }, "action_statement": "Vulnerability CVE-2024-39338 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-27152 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2025-27152" }, "action_statement": "Vulnerability CVE-2025-27152 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.7.5.", "vulnerability": { "name": "CVE-2025-54371" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-58754 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2025-58754" }, "action_statement": "Vulnerability CVE-2025-58754 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-62718 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2025-62718" }, "action_statement": "Vulnerability CVE-2025-62718 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101898 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101898" }, "action_statement": "Vulnerability CVE-2026-101898 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101899 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101899" }, "action_statement": "Vulnerability CVE-2026-101899 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101900 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101900" }, "action_statement": "Vulnerability CVE-2026-101900 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101901 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101901" }, "action_statement": "Vulnerability CVE-2026-101901 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-10-10T21:47:00.099436+00:00", "status_notes": "Vulnerability CVE-2026-101902 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.6.", "vulnerability": { "name": "CVE-2026-101902" }, "action_statement": "Vulnerability CVE-2026-101902 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101903 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101903" }, "action_statement": "Vulnerability CVE-2026-101903 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-10-10T21:47:00.099436+00:00", "status_notes": "Vulnerability CVE-2026-101904 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.6.", "vulnerability": { "name": "CVE-2026-101904" }, "action_statement": "Vulnerability CVE-2026-101904 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.6." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101905 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101905" }, "action_statement": "Vulnerability CVE-2026-101905 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101906 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101906" }, "action_statement": "Vulnerability CVE-2026-101906 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:26:00.033918+00:00", "status_notes": "Vulnerability CVE-2026-101907 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101907" }, "action_statement": "Vulnerability CVE-2026-101907 affects version 1.7.5 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-30T16:36:57.583767+00:00", "status_notes": "Vulnerability CVE-2026-101908 does not affect version 1.7.5 of axios. not_affected \u2014 Version 1.7.5 is not affected by CVE-2026-101908. The vulnerability requires passing fetchOptions as the second argument to fetch(), creating a path for prototype-polluted properties to override the Request's headers. This pattern was introduced in commit 0f50af8e (June 2025), first appearing in v1.10.0. Version 1.7.5 predates this change and calls fetch(request) with only one argument, prevent...", "justification": "vulnerable_code_not_in_execute_path", "vulnerability": { "name": "CVE-2026-101908" }, "impact_statement": "not_affected \u2014 Version 1.7.5 is not affected by CVE-2026-101908. The vulnerability requires passing fetchOptions as the second argument to fetch(), creating a path for prototype-polluted properties to override the Request's headers. This pattern was introduced in commit 0f50af8e (June 2025), first appearing in v1.10.0. Version 1.7.5 predates this change and calls fetch(request) with only one argument, prevent..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-101909 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-101909" }, "action_statement": "Vulnerability CVE-2026-101909 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-25639 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-25639" }, "action_statement": "Vulnerability CVE-2026-25639 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-04T11:49:00.031657+00:00", "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.7.5 of axios. not_affected \u2014 Target version 1.7.5 is not affected by CVE-2026-39865. The vulnerability exists in the HTTP/2 session cleanup logic (Http2Sessions class), which was introduced in axios v1.13.0 (October 2025). Target version 1.7.5 was released 14 months earlier (August 2024) and contains no HTTP/2 implementation. Exhaustive code search confirmed zero HTTP/2-related code across all 63 source files in lib/. Sinc...", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-39865" }, "impact_statement": "not_affected \u2014 Target version 1.7.5 is not affected by CVE-2026-39865. The vulnerability exists in the HTTP/2 session cleanup logic (Http2Sessions class), which was introduced in axios v1.13.0 (October 2025). Target version 1.7.5 was released 14 months earlier (August 2024) and contains no HTTP/2 implementation. Exhaustive code search confirmed zero HTTP/2-related code across all 63 source files in lib/. Sinc..." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-40175 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-40175" }, "action_statement": "Vulnerability CVE-2026-40175 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42033 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42033" }, "action_statement": "Vulnerability CVE-2026-42033 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42034 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42034" }, "action_statement": "Vulnerability CVE-2026-42034 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42035 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42035" }, "action_statement": "Vulnerability CVE-2026-42035 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42036 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42036" }, "action_statement": "Vulnerability CVE-2026-42036 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42037 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42037" }, "action_statement": "Vulnerability CVE-2026-42037 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42038 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42038" }, "action_statement": "Vulnerability CVE-2026-42038 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42039 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42039" }, "action_statement": "Vulnerability CVE-2026-42039 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42040 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42040" }, "action_statement": "Vulnerability CVE-2026-42040 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42041 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42041" }, "action_statement": "Vulnerability CVE-2026-42041 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42042 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42042" }, "action_statement": "Vulnerability CVE-2026-42042 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42043 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42043" }, "action_statement": "Vulnerability CVE-2026-42043 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42044 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42044" }, "action_statement": "Vulnerability CVE-2026-42044 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-42264 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-42264" }, "action_statement": "Vulnerability CVE-2026-42264 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44486 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.5.", "vulnerability": { "name": "CVE-2026-44486" }, "action_statement": "Vulnerability CVE-2026-44486 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.5." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44487 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.3.", "vulnerability": { "name": "CVE-2026-44487" }, "action_statement": "Vulnerability CVE-2026-44487 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44488 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2.", "vulnerability": { "name": "CVE-2026-44488" }, "action_statement": "Vulnerability CVE-2026-44488 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.2." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-44489 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-44489" }, "action_statement": "Vulnerability CVE-2026-44489 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44490 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.3.", "vulnerability": { "name": "CVE-2026-44490" }, "action_statement": "Vulnerability CVE-2026-44490 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44492 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-44492" }, "action_statement": "Vulnerability CVE-2026-44492 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44494 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44494" }, "action_statement": "Vulnerability CVE-2026-44494 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44495 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-44495" }, "action_statement": "Vulnerability CVE-2026-44495 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-44496 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.3.", "vulnerability": { "name": "CVE-2026-44496" }, "action_statement": "Vulnerability CVE-2026-44496 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.3." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-67312 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-67312" }, "action_statement": "Vulnerability CVE-2026-67312 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-67313 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-67313" }, "action_statement": "Vulnerability CVE-2026-67313 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:24:00.053852+00:00", "status_notes": "Vulnerability CVE-2026-67314 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-67314" }, "action_statement": "Vulnerability CVE-2026-67314 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67315 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-67315" }, "action_statement": "Vulnerability CVE-2026-67315 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-67316 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-67316" }, "action_statement": "Vulnerability CVE-2026-67316 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-67317 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-67317" }, "action_statement": "Vulnerability CVE-2026-67317 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-06T21:15:07.675710+00:00", "status_notes": "Vulnerability CVE-2026-67318 does not affect version 1.7.5 of axios. not_affected \u2014 axios 1.7.5 has no HTTP/2 support, so the vulnerable http2Transport path does not exist. Streamed bodies with a finite maxBodyLength go through follow-redirects, which enforces the cap, or through the byte-counting wrapper when maxRedirects is 0. No path sends an uncapped stream.", "vulnerability": { "name": "CVE-2026-67318" }, "impact_statement": "not_affected \u2014 axios 1.7.5 has no HTTP/2 support, so the vulnerable http2Transport path does not exist. Streamed bodies with a finite maxBodyLength go through follow-redirects, which enforces the cap, or through the byte-counting wrapper when maxRedirects is 0. No path sends an uncapped stream." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-30T08:14:17.776706+00:00", "status_notes": "Vulnerability CVE-2026-67319 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1.", "vulnerability": { "name": "CVE-2026-67319" }, "action_statement": "Vulnerability CVE-2026-67319 affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.1." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67320 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-67320" }, "action_statement": "Vulnerability CVE-2026-67320 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability CVE-2026-67321 affects version 1.7.5 of axios.", "vulnerability": { "name": "CVE-2026-67321" }, "action_statement": "Vulnerability CVE-2026-67321 affects version 1.7.5 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-38gx-cfqf-f652" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-39j5-w47m-2gmv" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-3mcp-22mf-vrw3" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.7.5 of axios.", "vulnerability": { "name": "GHSA-42h9-826w-cgv3" }, "action_statement": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.7.5 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-4ww2-rjh2-xpv9" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-68jp-44vc-2x5h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-6hqm-hm2v-3p2p" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.7.5 of axios.", "vulnerability": { "name": "GHSA-7q8q-rj6j-mhjq" }, "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.7.5 of axios." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-9wx3-p993-35vp" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-f2r5-pqh9-r8f8" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-10-20T12:46:51.138394+00:00", "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-fq2j-3j99-rx65" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "not_affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-11-03T07:25:00.602131+00:00", "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.7.5.", "vulnerability": { "name": "GHSA-fqj3-h9pc-443h" }, "impact_statement": "The vulnerability has been withdrawn." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-jqh4-m9w3-8hp9 affects version 1.7.5 of axios.", "vulnerability": { "name": "GHSA-jqh4-m9w3-8hp9" }, "action_statement": "Vulnerability GHSA-jqh4-m9w3-8hp9 affects version 1.7.5 of axios." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.4.", "vulnerability": { "name": "GHSA-mmx7-hfxf-jppx" }, "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.7.5 of axios, and is fixed in 1.7.5-tuxcare.4." }, { "status": "affected", "products": [ { "@id": "pkg:npm/axios@1.7.5", "identifiers": { "purl": "pkg:npm/axios@1.7.5" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.7.5 of axios.", "vulnerability": { "name": "GHSA-pmv8-rq9r-6j72" }, "action_statement": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.7.5 of axios." } ] }