{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:3bcaeaa3-2832-5e61-8497-d37cb3c2afc9",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "axios",
      "purl": "pkg:npm/axios@0.18.0",
      "type": "library",
      "bom-ref": "pkg:npm/axios@0.18.0",
      "version": "0.18.0",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2019-10742",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:2123745c-e2ac-5c7a-a55b-402c0c52dbc2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2019-10742 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2020-28168",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:892b9136-84bc-53ab-8140-c195c65e4141",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-28168 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2021-3749",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:73fa70ae-16b5-5184-a89f-50c567ae3ed2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3749 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2023-45857",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:46e3ca7d-bdcc-59d9-af18-f7e21a5f9728",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-45857 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2025-27152",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:28acbc3d-bd92-5532-8ecc-d357e6165b84",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-27152 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2025-62718",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:15f6c789-df50-5d64-b14d-d49e4f512b02",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2025-62718 does not affect version 0.18.0 of axios. not_affected \u2014 Axios version 0.18.0 is not affected by CVE-2025-62718 because the NO_PROXY functionality was not introduced until version 0.19.0 (August 2018), approximately 6 months after v0.18.0 was released (February 2018). The vulnerability specifically concerns improper hostname normalization in NO_PROXY matching logic, but since v0.18.0 has no NO_PROXY support whatsoever, the vulnerable code pattern can...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-25639",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:5194f540-267c-537e-a059-358c635d1621",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25639 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-40175",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:80c19afd-2490-5a66-b2bc-e36f3f67a0de",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40175 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42033",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:13c0e77e-0796-5b79-98a6-9a352a72b153",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42033 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42034",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:ec842db1-0635-5cbc-a64e-3461b3e3f5d9",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42034 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42035",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:a7a2416f-abb5-5f38-a1b7-c08a817cc00b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42035 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42036",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:e3eff5c0-c45f-56b3-a9c4-9a8afb50c02a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42036 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42038",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:b2f80a3f-087a-52d9-9c12-e8f6c6652e89",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42038 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42039",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:5ff6c798-9006-5f94-b214-9c233a6d03f4",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42039 does not affect version 0.18.0 of axios. not_affected \u2014 Axios 0.18.0 is not affected by CVE-2026-42039. The vulnerable code (lib/helpers/toFormData.js with its unbounded recursive walker) does not exist in this version - it was introduced later in v0.25.0. Version 0.18.0 uses JSON.stringify() for object serialization, which does not crash at the CVE's attack depth (2,500 levels). Empirical testing confirms JSON.stringify succeeds at depth 2,500 and ...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42040",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:740d87a8-bce8-5e68-b260-e6355f40ab37",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42040 does not affect version 0.18.0 of axios. not_affected \u2014 Version 0.18.0 is not affected by CVE-2026-42040. The vulnerable component (lib/helpers/AxiosURLSearchParams.js with the null-byte reverse-encoding bug) does not exist in this version. Version 0.18.0 uses a different URL encoding mechanism (buildURL.js) that safely preserves percent-encoded null bytes (%00) without reversing them to raw null bytes (\\x00). The AxiosURLSearchParams feature was in...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42041",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:1b9c37a5-83e8-544d-8044-a3628e860def",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42041 does not affect version 0.18.0 of axios. not_affected \u2014 Version 0.18.0 is NOT affected by CVE-2026-42041. The vulnerability exists in the `mergeDirectKeys` function within `lib/core/mergeConfig.js`, which uses the `in` operator for property checking. This architectural component was introduced in commit 0d69a79c (June 2020) and first appeared in v0.20.0. Version 0.18.0 (February 2018) pre-dates this change and uses a different config merging strateg...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42042",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:a6940d9b-ece9-569c-b69c-684994524da3",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42042 does not affect version 0.18.0 of axios. not_affected \u2014 CVE-2026-42042 describes a prototype pollution gadget in the `withXSRFToken` config option that causes XSRF tokens to leak cross-origin when truthy non-boolean values short-circuit the same-origin check. The target (axios v0.18.0 from February 2018) does not have the `withXSRFToken` config option at all - this feature was introduced in November 2023, 5+ years after v0.18.0 was released. The vul...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42043",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:b1a8a983-c1ac-57e2-b47a-9f49562e5baa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42043 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44486",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:8a3d6f8a-0e98-509f-8adb-0b59375e90af",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44486 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44487",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:a736076a-b919-5c00-9197-0f102b069b77",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44487 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44490",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:b73716fa-9a24-5bda-a465-25e0b8f22bfd",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44490 affects version 0.18.0 of axios, and is fixed in 0.18.0-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-44492",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:6454305e-975e-5c6b-869d-c9883ac71012",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44492 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44496",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:b26cb14d-3324-53e1-a669-2f6346d708ee",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44496 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-67316",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:4f7ad915-0baf-5c4e-86ff-6519f67f97e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67316 affects version 0.18.0 of axios."
      }
    },
    {
      "id": "CVE-2026-67319",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.18.0"
        }
      ],
      "bom-ref": "urn:uuid:1a10b2aa-5fc0-5abc-a673-257486d0112b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67319 affects version 0.18.0 of axios."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@0.18.0"
    }
  ]
}