{
  "@id": "urn:uuid:aebc54ea-e569-403a-bd3c-7797aa678021",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 16,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-06T21:19:00.030345+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2019-10742 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2019-10742"
      },
      "action_statement": "Vulnerability CVE-2019-10742 affects version 1.7.7 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-04T11:08:00.187739+00:00",
      "status_notes": "Vulnerability CVE-2020-28168 does not affect version 1.7.7 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirects) is not present in axios 1.7.7-tuxcare.8. The vulnerability was fixed in upstream commit c7329fef by Daniel Lopretto, which shipped in the upstream release before TuxCare onboarding (first TuxCare commit 8866c1fb). The fix adds a beforeRedirect callback that re-applies proxy configuration to redirect requests, preventing direct connections to r...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2020-28168"
      },
      "impact_statement": "not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirects) is not present in axios 1.7.7-tuxcare.8. The vulnerability was fixed in upstream commit c7329fef by Daniel Lopretto, which shipped in the upstream release before TuxCare onboarding (first TuxCare commit 8866c1fb). The fix adds a beforeRedirect callback that re-applies proxy configuration to redirect requests, preventing direct connections to r..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2021-3749 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2021-3749"
      },
      "action_statement": "Vulnerability CVE-2021-3749 affects version 1.7.7 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-04T11:30:26.100933+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 does not affect version 1.7.7 of axios. not_affected \u2014 CVE-2023-45857 is NOT present in axios 1.7.7-tuxcare.8. The vulnerability, which allowed XSRF tokens to leak to cross-origin hosts when withCredentials was set, was fixed in the upstream v1.7.7 release before TuxCare onboarding. The current code in lib/helpers/resolveConfig.js (lines 50-64) only sends XSRF tokens when withXSRFToken===true (explicit opt-in) or when withXSRFToken==null AND isURLS...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "impact_statement": "not_affected \u2014 CVE-2023-45857 is NOT present in axios 1.7.7-tuxcare.8. The vulnerability, which allowed XSRF tokens to leak to cross-origin hosts when withCredentials was set, was fixed in the upstream v1.7.7 release before TuxCare onboarding. The current code in lib/helpers/resolveConfig.js (lines 50-64) only sends XSRF tokens when withXSRFToken===true (explicit opt-in) or when withXSRFToken==null AND isURLS..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2024-39338 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2024-39338"
      },
      "action_statement": "Vulnerability CVE-2024-39338 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "action_statement": "Vulnerability CVE-2025-27152 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2025-54371 is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "CVE-2025-54371"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-58754 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2025-58754"
      },
      "action_statement": "Vulnerability CVE-2025-58754 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "action_statement": "Vulnerability CVE-2025-62718 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101898 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101898"
      },
      "action_statement": "Vulnerability CVE-2026-101898 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101899 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101899"
      },
      "action_statement": "Vulnerability CVE-2026-101899 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101900 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101900"
      },
      "action_statement": "Vulnerability CVE-2026-101900 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101901 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101901"
      },
      "action_statement": "Vulnerability CVE-2026-101901 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-10T21:06:00.208216+00:00",
      "status_notes": "Vulnerability CVE-2026-101902 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-101902"
      },
      "action_statement": "Vulnerability CVE-2026-101902 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101903 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101903"
      },
      "action_statement": "Vulnerability CVE-2026-101903 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-10T21:07:00.113444+00:00",
      "status_notes": "Vulnerability CVE-2026-101904 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.7.",
      "vulnerability": {
        "name": "CVE-2026-101904"
      },
      "action_statement": "Vulnerability CVE-2026-101904 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.7."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101905 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101905"
      },
      "action_statement": "Vulnerability CVE-2026-101905 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101906 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101906"
      },
      "action_statement": "Vulnerability CVE-2026-101906 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:26:00.033918+00:00",
      "status_notes": "Vulnerability CVE-2026-101907 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101907"
      },
      "action_statement": "Vulnerability CVE-2026-101907 affects version 1.7.7 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T16:36:57.583767+00:00",
      "status_notes": "Vulnerability CVE-2026-101908 does not affect version 1.7.7 of axios. not_affected \u2014 Target version 1.7.7-tuxcare.1 is NOT AFFECTED by CVE-2026-101908. The vulnerable code pattern (passing fetchOptions as the second argument to fetch()) does not exist in this version. The target code at lib/adapters/fetch.js:272 calls `fetch(request)` with no second argument, preventing inherited prototype-polluted properties from overriding the Request's safe headers. The vulnerability was int...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-101908"
      },
      "impact_statement": "not_affected \u2014 Target version 1.7.7-tuxcare.1 is NOT AFFECTED by CVE-2026-101908. The vulnerable code pattern (passing fetchOptions as the second argument to fetch()) does not exist in this version. The target code at lib/adapters/fetch.js:272 calls `fetch(request)` with no second argument, preventing inherited prototype-polluted properties from overriding the Request's safe headers. The vulnerability was int..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-101909 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-101909"
      },
      "action_statement": "Vulnerability CVE-2026-101909 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "action_statement": "Vulnerability CVE-2026-25639 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-04T11:42:00.096965+00:00",
      "status_notes": "Vulnerability CVE-2026-39865 does not affect version 1.7.7 of axios. not_affected \u2014 CVE-2026-39865 does not affect axios v1.7.7 because HTTP/2 support and the vulnerable Http2Sessions class do not exist in this version. HTTP/2 support was introduced in v1.13.0 (commit d676df77), which is 6 minor versions after v1.7.7. The vulnerable session cleanup code in Http2Sessions.getSession() that allows array iteration after modification via splice() was never present in v1.7.7, as the...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-39865"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-39865 does not affect axios v1.7.7 because HTTP/2 support and the vulnerable Http2Sessions class do not exist in this version. HTTP/2 support was introduced in v1.13.0 (commit d676df77), which is 6 minor versions after v1.7.7. The vulnerable session cleanup code in Http2Sessions.getSession() that allows array iteration after modification via splice() was never present in v1.7.7, as the..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "action_statement": "Vulnerability CVE-2026-40175 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "action_statement": "Vulnerability CVE-2026-42033 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "action_statement": "Vulnerability CVE-2026-42034 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "action_statement": "Vulnerability CVE-2026-42035 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "action_statement": "Vulnerability CVE-2026-42036 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42037 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42037"
      },
      "action_statement": "Vulnerability CVE-2026-42037 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "action_statement": "Vulnerability CVE-2026-42038 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "action_statement": "Vulnerability CVE-2026-42039 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "action_statement": "Vulnerability CVE-2026-42040 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "action_statement": "Vulnerability CVE-2026-42041 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "action_statement": "Vulnerability CVE-2026-42042 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "action_statement": "Vulnerability CVE-2026-42043 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42044 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42044"
      },
      "action_statement": "Vulnerability CVE-2026-42044 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-42264 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-42264"
      },
      "action_statement": "Vulnerability CVE-2026-42264 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.6.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.6."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44488 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3.",
      "vulnerability": {
        "name": "CVE-2026-44488"
      },
      "action_statement": "Vulnerability CVE-2026-44488 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.3."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-44489 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44489"
      },
      "action_statement": "Vulnerability CVE-2026-44489 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44490"
      },
      "action_statement": "Vulnerability CVE-2026-44490 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-27T11:28:00.087170+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.8.",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "action_statement": "Vulnerability CVE-2026-44492 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.8."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-44494 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44494"
      },
      "action_statement": "Vulnerability CVE-2026-44494 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.4.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.4."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67312 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67312"
      },
      "action_statement": "Vulnerability CVE-2026-67312 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67313 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67313"
      },
      "action_statement": "Vulnerability CVE-2026-67313 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:24:00.053852+00:00",
      "status_notes": "Vulnerability CVE-2026-67314 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67314"
      },
      "action_statement": "Vulnerability CVE-2026-67314 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67315 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67315"
      },
      "action_statement": "Vulnerability CVE-2026-67315 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67317 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67317"
      },
      "action_statement": "Vulnerability CVE-2026-67317 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-06T21:19:00.030345+00:00",
      "status_notes": "Vulnerability CVE-2026-67318 does not affect version 1.7.7 of axios. not_affected \u2014 axios 1.7.7 (tuxcare.8) has no HTTP/2 support, so the CVE's bypass path does not exist. The only transports are native http/https and follow-redirects. Streamed uploads are limited on both: follow-redirects enforces options.maxBodyLength, and the byte-counting wrapper in lib/adapters/http.js covers the maxRedirects===0 native path.",
      "vulnerability": {
        "name": "CVE-2026-67318"
      },
      "impact_statement": "not_affected \u2014 axios 1.7.7 (tuxcare.8) has no HTTP/2 support, so the CVE's bypass path does not exist. The only transports are native http/https and follow-redirects. Streamed uploads are limited on both: follow-redirects enforces options.maxBodyLength, and the byte-counting wrapper in lib/adapters/http.js covers the maxRedirects===0 native path."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-30T08:14:17.776706+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67320 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67320"
      },
      "action_statement": "Vulnerability CVE-2026-67320 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability CVE-2026-67321 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67321"
      },
      "action_statement": "Vulnerability CVE-2026-67321 affects version 1.7.7 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-38gx-cfqf-f652"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-39j5-w47m-2gmv"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-3mcp-22mf-vrw3"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "GHSA-42h9-826w-cgv3"
      },
      "action_statement": "Vulnerability GHSA-42h9-826w-cgv3 affects version 1.7.7 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-4ww2-rjh2-xpv9"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-68jp-44vc-2x5h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-6hqm-hm2v-3p2p"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "GHSA-7q8q-rj6j-mhjq"
      },
      "action_statement": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 1.7.7 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-9wx3-p993-35vp"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-f2r5-pqh9-r8f8"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-10-20T12:46:51.138394+00:00",
      "status_notes": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-fq2j-3j99-rx65"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-11-03T07:25:00.602131+00:00",
      "status_notes": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.7.7.",
      "vulnerability": {
        "name": "GHSA-fqj3-h9pc-443h"
      },
      "impact_statement": "The vulnerability has been withdrawn."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-jqh4-m9w3-8hp9 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "GHSA-jqh4-m9w3-8hp9"
      },
      "action_statement": "Vulnerability GHSA-jqh4-m9w3-8hp9 affects version 1.7.7 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.5.",
      "vulnerability": {
        "name": "GHSA-mmx7-hfxf-jppx"
      },
      "action_statement": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 1.7.7 of axios, and is fixed in 1.7.7-tuxcare.5."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@1.7.7",
          "identifiers": {
            "purl": "pkg:npm/axios@1.7.7"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.7.7 of axios.",
      "vulnerability": {
        "name": "GHSA-pmv8-rq9r-6j72"
      },
      "action_statement": "Vulnerability GHSA-pmv8-rq9r-6j72 affects version 1.7.7 of axios."
    }
  ]
}