{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:916133fd-450c-594c-aa82-bac69b5e218a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.21.2-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/axios@0.21.2-tuxcare.2", "version": "0.21.2-tuxcare.2", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@0.21.2", "type": "library", "version": "0.21.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:58c65883-7ae6-5895-8062-f915f16c9696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:14b866a0-e071-5e69-9807-9a2089ae6d5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:2a7b2bab-aede-5ef9-a769-220adfe5eb1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:043905b9-4776-5933-899f-5b3664647722", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:aafcaed3-d917-571f-83b5-e598a4e266ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b00eabb9-6380-56b2-be1c-1d466afcc0fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42033 affects version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:889b2da0-ccea-52b7-b74c-0004b541f981", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c92949cb-df53-5aeb-bfbc-d1bf24fb1ca6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42035 does not affect version 0.21.2-tuxcare.2 of axios. 0.21.2 http adapter has no FormData getHeaders() call; the gadget first appears in axios 0.27.0. Verified against the npm tarball (manual review 2026-10-26).", "justification": "code_not_present" } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:5fbad008-e0ce-591f-a41a-678365805787", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7241d568-604a-531e-b497-3021333c79b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:196d64cc-fb7b-5c0d-9a44-f9d731f748b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42039 does not affect version 0.21.2-tuxcare.2 of axios. not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a86f8cc5-b8be-5876-a2be-881bc5231497", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 0.21.2-tuxcare.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d4bb5136-4d51-58de-88ac-8aa9b22e2df2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42041 affects version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f479961c-1d21-557d-86f0-633fd19e29cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 0.21.2-tuxcare.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear...", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4a0615d5-5e39-511e-8df7-b845a75d7b52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42043 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ebf805c4-f00d-5b8a-80bb-20859f62d78d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:824fa4a9-361b-5eb5-8164-a28682711251", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4fe2f9a4-06ab-5979-9b61-00b2bd09a51f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9f2ceadb-e644-52d4-a3d8-d9a7b953f09c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44492 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:36e78c3e-6be1-59ee-ae65-5e5a6910c032", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:bc6a92b4-ad17-5095-b21d-c210a617195a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9ae7065f-7874-59b4-a950-6cd18412cb6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67312 affects version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:04e79d09-007b-5e96-81a1-f699cd44fd7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b735d830-e10c-56e1-a303-07811bf04633", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.21.2-tuxcare.2 of axios." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ], "bom-ref": "urn:uuid:91f5bef7-32ee-57b0-a735-eb876c89e0c9", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.21.2-tuxcare.2." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.21.2-tuxcare.2" } ] }