{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8ad7b71a-82ce-5432-b82a-e5cb52bf870f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.27.2", "type": "library", "bom-ref": "pkg:npm/axios@0.27.2", "version": "0.27.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2019-10742", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:f0be4bf8-06e3-535b-b6f7-3e74a43f09ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2019-10742 affects version 0.27.2 of axios." } }, { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:5da246fe-2f12-567e-ae3b-243e83a4012c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-28168 does not affect version 0.27.2 of axios. not_affected \u2014 CVE-2020-28168 (SSRF via proxy bypass on redirect) is NOT present in axios v0.27.2-tuxcare.6. The vulnerability allowed attackers to bypass proxy settings by returning an HTTP redirect to a restricted host. The upstream fix (commit c7329fefc890050edd51e40e469a154d0117fc55 by Daniel Lopretto, merged Nov 24, 2020) added a beforeRedirect callback that re-applies proxy configuration on every redire...", "justification": "code_not_present" } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:8ae51883-85d5-5894-8da8-cd15a3409ec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-3749 affects version 0.27.2 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:7210fd8c-ff08-5442-9c2e-96c14a9855a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-45857 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.1." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:71262d12-9133-5924-8409-83538e0e2b09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-39338 does not affect version 0.27.2 of axios. Version 0.27.2 is not vulnerable. Summary: The target repository (axios 0.27.2-tuxcare.1) is NOT vulnerable to CVE-2024-39338. It uses the legacy url.parse() API instead of the vulnerable new URL() constructor with hardcoded 'http://localhost' base. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:d6a92dae-7863-5998-ac79-c746d27b8ce1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-27152 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.1." } }, { "id": "CVE-2025-54371", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:baff92ff-39ad-5693-b3fd-088eecb1b895", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-54371 is a false positive for axios 0.27.2." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:c38643c9-7dba-50e0-9bfa-60052f3bbe38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-58754 affects version 0.27.2 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:9b318014-209f-5493-aa3e-0a11e6ccbd8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62718 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:8a8bc9d1-785d-5afe-b5b9-20cdfcc8d1e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101899", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:582037d5-f189-53ff-b216-17e95066ed9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101899 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.6." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:b3c8e102-ec51-5a5d-a027-423eebb4d1bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101900 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:5811a637-93eb-59e8-bedc-671ec9f8e01f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:f04f94fb-4122-5b70-8892-17e71eb14513", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.6." } }, { "id": "CVE-2026-101903", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:e6421537-55d5-566b-bca9-40f7090dc37b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101903 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:882a79cc-4fc0-5504-9ebb-c0ffa4413ca4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.6." } }, { "id": "CVE-2026-101905", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:5df48b14-1ad7-53f4-9fc5-8701648a9a33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101905 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101906", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:faf27814-a97a-55f2-ab36-d09cedef2ced", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101906 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101907", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:8477d4d8-e895-547b-82df-09bfaf38fd06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101907 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:911a1701-165b-515e-9f49-44cc7b4866e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-101909", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:fc3e768e-64ae-5600-b578-4f9be71c8cdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101909 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.6." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:566fa994-28d5-5c9a-a3b2-a518f6540719", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25639 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.2." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:5cfa0a00-591e-55a4-8467-1a3aa8350e11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.27.2 of axios. not_affected \u2014 Target axios version 0.27.2-tuxcare.4 is not affected by CVE-2026-39865. The vulnerability requires HTTP/2 session management code (Http2Sessions class with getSession method) that does not exist in this version. HTTP/2 support was added to axios in version 1.x (commit d676df77, October 2025), while this target is based on axios 0.27.2 from April 2022 and only supports HTTP/1.x. The vulnerable ...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:b284f2fa-b4cd-5b06-a40f-d370d3340f0e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40175 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:156c89b8-ef7d-5282-b5f7-0676160ff697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42033 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:f0066fb8-c981-57e3-9409-e35695f3edd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42034 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:5caf2dc0-20da-5d8a-9260-a5145be8b6f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42035 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:f57160a5-3795-5448-94bb-16c7da6fbcd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42036 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:d7cf41ed-2aca-51eb-89a9-0f287589a641", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42037 does not affect version 0.27.2 of axios. not_affected \u2014 Version 0.27.2 does not contain the vulnerable code path. The file lib/helpers/formDataToStream.js that contains the CRLF injection vulnerability was introduced in axios v1.3.0 (January 2023) to support spec-compliant FormData. Version 0.27.2 only supports the npm form-data package and explicitly rejects spec-compliant FormData objects. TuxCare backported CVE-2026-42037 fixes to versions 1.7.9,...", "justification": "code_not_present" } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:7fb6939a-3d92-5fe7-b2ae-1d84a8c1aa79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42038 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:a5e5dbd7-0dba-5989-8a67-60114ee617b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42039 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.4." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:4d4dd3ce-f266-5e77-9600-3920912618a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 0.27.2 of axios. not_affected \u2014 The target version (axios 0.27.2-tuxcare.4) is NOT AFFECTED by CVE-2026-42040. The vulnerable component (lib/helpers/AxiosURLSearchParams.js) does not exist in this version. Historical analysis shows this file was introduced in commit 934f390c, which is 65 commits AFTER the v0.27.2 release and first appeared in v0.28.0. In v0.27.2, URL parameter encoding is handled by lib/helpers/buildURL.js:en...", "justification": "code_not_present" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:e0d98d6c-8d03-590c-955b-d9f641a6ef69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42041 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:d3fb0ee1-4e05-58a7-9a40-ab63c3fbe6da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 0.27.2 of axios. not_affected \u2014 Target version 0.27.2-tuxcare.4 is NOT affected by CVE-2026-42042. The vulnerability requires the `withXSRFToken` configuration feature, which was never introduced to the 0.27.2 lineage. The XSRF token logic in this version always enforces same-origin checking via `isURLSameOrigin(fullPath)` with no bypass conditions. Prototype pollution of `Object.prototype.withXSRFToken` has no effect because...", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:0d0c8259-417d-5ab0-8bf5-17933b3328c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42043 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:11c77087-499d-5b6c-8c1f-bd282656ccdd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42044 does not affect version 0.27.2 of axios. not_affected \u2014 Axios 0.27.2 does not have the parseReviver feature. The CVE describes a prototype pollution vulnerability in `JSON.parse(data, this.parseReviver)` introduced in axios v1.12.0 (September 2025). The target version 0.27.2 uses `JSON.parse(data)` without a reviver parameter. The vulnerable code path does not exist in this version. The CVE's claim that it affects \"all versions (v0.x - v1.x)\" is fac...", "justification": "code_not_present" } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:23384236-0a84-57dd-a1bd-3d539a7df9bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:cf5dc1b3-e487-5770-aee4-16733c72aaf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44486 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.3." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:34ebca8c-f3f4-51ca-8ab1-a69135a6e872", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44487 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.3." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:ce663447-2c11-547d-b4d4-20efd760b31a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-44489", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:a92c5c7e-f8d6-5015-a173-3105d53c82c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44489 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:08f1e3fd-9452-59d7-a66d-8b99da6ae8ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44490 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.3." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:2a575dd8-3205-5d75-a6f8-9f3781948155", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44492 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:c5f23d46-7f92-5587-aa23-ffc611aa879d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:e44184f3-6f5b-597a-99ba-3d37fdd1fde7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:8623f15c-a274-545f-87c5-0b6be0df1156", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44496 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.3." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:30309275-0ce5-5eb6-af0d-3de9ae78b87a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67312 does not affect version 0.27.2 of axios. not_affected \u2014 axios 0.27.2 is NOT affected by CVE-2026-67312. The vulnerable formDataToJSON feature (which converts FormData to JSON objects and contains the unbounded recursion vulnerability in buildPath()) does not exist in this version. The feature was introduced in commit c008e57f on May 25, 2022, after the 0.27.2 release (April 27, 2022). The CVE's affected version range (0.28.0-0.33.0, 1.0.0-1.18.0) is...", "justification": "code_not_present" } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:f077e966-1814-553b-895c-ce81b92d7df9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67313 does not affect version 0.27.2 of axios. not_affected \u2014 Target is axios 0.27.2-tuxcare.6. CVE-2026-67313 concerns uncontrolled recursion in lib/helpers/formDataToJSON.js (axios.formToJSON and the FormData-to-JSON request transform), which only exists from 0.28.0. This tree has no formDataToJSON, no formToJSON export, and no FormData-to-JSON conversion in transformRequest. The advisory's Input (deeply nested bracket field names) has no chain to the G...", "justification": "code_not_present" } }, { "id": "CVE-2026-67314", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:9afe9871-3a73-5990-8bb2-459ecfa7efd1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67314 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-67315", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:b1048443-19eb-57bd-be7c-ad683da61662", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67315 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:cdad81eb-891c-5a0b-98f3-a54e674ec642", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67316 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:afc2e6c9-671d-5b57-93d1-a1fa641dd146", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67317 does not affect version 0.27.2 of axios. not_affected \u2014 Not affected. axios 0.27.2-tuxcare.6 has no fetch adapter, so the vulnerable code (lib/adapters/fetch.js, getBodyLength/resolveBodyLength/trackStream) does not exist. Only the http and xhr adapters exist. A WHATWG ReadableStream cannot reach the Goal of sending more bytes than maxBodyLength. The http adapter also enforces maxBodyLength on stream bodies.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:4d140a81-aa43-50fd-a843-0a478698efac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-67318 does not affect version 0.27.2 of axios. not_affected \u2014 Target is axios 0.27.2-tuxcare.6. It has no HTTP/2 support: no http2 module and no httpVersion option anywhere in lib/. The CVE's vulnerable path (the HTTP/2 transport, which skips the byte-counting wrapper for streamed uploads) does not exist here. In the target, streamed uploads go through follow-redirects, which enforces options.maxBodyLength, or through native http/https, which is wrapped b...", "justification": "code_not_present" } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:ca2bf2d6-da21-55f4-972a-b9e89e07fc5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67319 affects version 0.27.2 of axios, and is fixed in 0.27.2-tuxcare.5." } }, { "id": "CVE-2026-67320", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:1f440bfa-5df8-54c9-a91d-1001191575bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67320 affects version 0.27.2 of axios." } }, { "id": "CVE-2026-67321", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:577fb0ea-9247-5b0d-852a-bdfb3ccb0fcd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67321 affects version 0.27.2 of axios." } }, { "id": "GHSA-38gx-cfqf-f652", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:3d957d7b-c642-5488-bba3-74334cba2f2f", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-38gx-cfqf-f652 is a false positive for axios 0.27.2." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:ea20dbc7-0f5f-5ef0-90b4-425d661c68ec", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 0.27.2." } }, { "id": "GHSA-3mcp-22mf-vrw3", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:01e8e40e-47b3-506a-859a-b0b018c51efe", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-3mcp-22mf-vrw3 is a false positive for axios 0.27.2." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:b1de99e4-a73a-548a-9d7f-8082286eec97", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 0.27.2." } }, { "id": "GHSA-68jp-44vc-2x5h", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:17e59237-f8f3-55c7-9e96-9cfdea2308ea", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-68jp-44vc-2x5h is a false positive for axios 0.27.2." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:3105262a-7188-5a0d-9e33-76da5bd9087d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 0.27.2." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:9ea0598d-96db-5ab8-8c06-44cf7e91d8b2", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.27.2 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:95678c88-ba38-5cc8-b23d-734ba3f84eba", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 0.27.2." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:d3a0449a-dcf5-5e06-8826-cf3ae431423c", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.27.2." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:511fe9b3-a3f5-5505-b3a0-03d60a45a484", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 0.27.2." } }, { "id": "GHSA-fqj3-h9pc-443h", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:13cdad05-ce86-50d2-91a6-48d98b9a4d85", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 0.27.2." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.27.2" } ], "bom-ref": "urn:uuid:7d110c9b-e648-538c-bf75-c6e02c73fc36", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.27.2 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.27.2" } ] }