{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0420cc28-ea11-5b89-bb36-aa09bd6af85c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@1.13.2-tuxcare.2", "type": "library", "bom-ref": "pkg:npm/axios@1.13.2-tuxcare.2", "version": "1.13.2-tuxcare.2", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@1.13.2", "type": "library", "version": "1.13.2" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:694abbdd-1bc8-5d7a-a247-e3365757f224", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d969caac-6313-585c-90f3-0d17f6551965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101898 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:708310d6-a347-5004-a459-a9e8dac237be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101900 does not affect version 1.13.2-tuxcare.2 of axios. not_affected \u2014 Target version 1.13.2 is not affected by CVE-2026-101900. While the code calls data.getHeaders() without using getSafeProp (the vulnerable pattern), it includes an upstream-provided allowlist defense in resolveConfig.js (lines 33-38) that filters headers to only allow 'content-type' and 'content-length', preventing arbitrary header injection. This defense was introduced in upstream commit a9f47...", "justification": "code_not_present" } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:33003a37-4a49-5a42-b763-b8d8d919ac15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101901 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7aa7f1f4-5705-5759-8bad-04b35bfacd58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101902 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ded4a04c-67d2-5c00-87f4-6c5c32171342", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101904 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:d1349173-482a-5057-bcf7-31dcfd6260bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101908 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ac48e076-d8e0-52f5-8bd0-087224ece0d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:b5209ddc-d09b-52f4-bb53-bf3ace8d49a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a50685b4-7da5-505f-a082-99a30f24e6f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:69232951-f750-512e-98e3-06b476e5c1dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:e26f263b-173b-5efb-a69d-6c6a887878f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42035 affects version 1.13.2-tuxcare.2 of axios, and is fixed in 1.13.2-tuxcare.3." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:3c82a206-7017-50b8-9b3d-adbf2badc041", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:5d4da686-a695-5ed2-b811-814dff1264cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42037 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c2c5076d-6244-5784-acaf-43f87d25e3a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a87fd011-5a19-581c-a85f-2f1515c38bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:343a7f9b-0e75-5613-8bb8-70554c52f1f2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:fe16af75-7df2-5296-a194-fd56cb4b2d63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:9fd9a489-c5ea-570a-a3cc-370630da39d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7eb6c755-7c05-50c6-8f8d-2834aff61242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42043 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f0483d36-10e8-5ead-95fd-68227934ab4d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42044 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:dee76002-1555-5af9-bee4-cc259b495511", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42264 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4e89d2b2-47d3-5801-b7b1-1acd1aa05c3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a4a4ccb0-03bd-5125-9669-46cadf649819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:39aa4c95-b91a-56ab-a4ff-60447cdc1451", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44488 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:6c728d5b-fd6d-5238-bf84-dc3b672a672f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:01497abf-cb10-5b86-829a-c9f160798e12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44494 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:3ba0335a-860c-5697-a167-e71ae45cf8f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:45836944-7f06-52ef-827a-b35664d4a8ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:0996f2de-7ab4-57e2-84e8-038c0263c6b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67312 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f02ac5fc-1a56-5700-9d85-d675535526d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67313 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:e0b5c3b3-8913-5d70-86df-2f1f823bdd69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:4443b279-fb0a-5e48-a834-5d8c54fe015d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67317 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:dbfc7746-fe60-5ab7-9334-e139b92b65f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67318 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:a49ebb30-6e5c-5d6a-b92a-21ff6e9f1629", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 1.13.2-tuxcare.2 of axios." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:ca9f3919-c2fb-54d2-9ff3-b0f13169d55d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.13.2-tuxcare.2." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:7e9ae065-1fa4-5eb1-957c-18d8eb175910", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.13.2-tuxcare.2." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c1382f19-23e0-58aa-bc10-3b5e2fd05045", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.13.2-tuxcare.2." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:18f8981c-38f5-5c65-9b95-eee8fed5be0f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.13.2-tuxcare.2." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:c6fbd763-efa4-50e0-9150-311a06d52006", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.13.2-tuxcare.2." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ], "bom-ref": "urn:uuid:f064ad2e-d050-53d0-ae61-569b23ddc62c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.13.2-tuxcare.2." } } ], "dependencies": [ { "ref": "pkg:npm/axios@1.13.2-tuxcare.2" } ] }