{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:14c88aa0-e4ae-51dc-9858-1b78bba37bd1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.18.1-tuxcare.7", "type": "library", "bom-ref": "pkg:npm/axios@0.18.1-tuxcare.7", "version": "0.18.1-tuxcare.7", "pedigree": { "ancestors": [ { "name": "axios", "purl": "pkg:npm/axios@0.18.1", "type": "library", "version": "0.18.1" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2020-28168", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:61458eb1-38c0-5147-ac2a-8f61476bd96b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-28168 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2021-3749", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:b4e92c8b-ad56-5515-9289-19264d07db8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-3749 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:7c3f6a08-d762-5575-be57-fe4ae761e2bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:bb7a4278-d8cd-5bc1-aeff-5f995dd84523", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-39338 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:d325e792-b629-5c4a-8393-fb6b98b5dec0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:66e2b47a-381c-5ef2-9f86-7cba8f6f0cc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58754 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:990fc487-7dde-5082-b4b8-9578bd7c572a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-62718 does not affect version 0.18.1-tuxcare.7 of axios. axios 0.18.1 has no no_proxy support at all (added upstream in 38de2525, first released in 0.19.0), so the no_proxy hostname-normalization matching loop this CVE bypasses does not exist; the proxy is resolved solely via getProxyForUrl() with no hostname matching.", "justification": "code_not_present" } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:c12cb143-6863-596f-a1d1-fec5f135cb34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-39865", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:d34b1f24-dc56-5758-8423-09a6d2987068", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-39865 does not affect version 0.18.1-tuxcare.7 of axios. not_affected \u2014 The target repository (axios 0.18.1-tuxcare.4) is not affected by CVE-2026-39865. This CVE describes an HTTP/2 session cleanup state corruption bug in the Http2Sessions class that was fixed in axios 1.13.2. The target version (0.18.1) predates the introduction of HTTP/2 support in axios, which was added in the 1.x series. The target's lib/adapters/http.js (302 lines) only supports HTTP/1.1 usin...", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:74eb6bf3-e8e0-53dc-b72a-d29157485d1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:98897694-9244-591e-8d39-672c0730630d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:8a97166d-c80b-5fd3-b277-475289c8a5a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42034 does not affect version 0.18.1-tuxcare.7 of axios. axios 0.18.1 never reads config.maxBodyLength; lib/defaults.js defines only maxContentLength (a response-size limit), so there is no configurable request-body limit to bypass. Confirmed with a PoC against 0.18.1.", "justification": "code_not_present" } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:87533141-b868-5f6a-9e45-2685b647e95b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42035 does not affect version 0.18.1-tuxcare.7 of axios. Version 0.18.1 (SHA 3256bcea) is NOT affected by CVE-2026-42035. The vulnerable code path does not exist in this version. The attack requires two components: (1) a duck-typed isFormData() function that can be fooled by prototype pollution, and (2) code in lib/adapters/http.js that calls data.getHeaders() and merges the result into request headers. Version 0.18.1 has NEITHER: isFormData() uses instanceof (cannot be spoofed), and http.js has no getHeaders() call. The vulnerable code was introduced AFTER this version in a major ES6 rewrite (302\u2192751 lines), then fixed by commit 854c54e0 authored by CloudLinux engineer Krystyna Tomaszewa. Type A2: INPUT (plain object with polluted properties) is received but no code path reaches GOAL (header injection) because transformRequest JSON-stringifies plain objects before they reach the http adapter.", "justification": "code_not_present" } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:867584fb-c76b-564f-a6e4-68f923889f37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:3141ae71-4b76-5b95-abcf-da11a51c0e7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42038 does not affect version 0.18.1-tuxcare.7 of axios. The loopback-equivalence bug lives entirely inside the no_proxy matching loop of lib/adapters/http.js, and axios 0.18.1 has no no_proxy support (added upstream in 38de2525, first released in 0.19.0); neither the matching loop nor isLoopbackHost.js exists.", "justification": "code_not_present" } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:945f2644-abc4-5ff1-92f2-7ee0afedf7ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:30d98b11-5335-575d-af4d-d66d06a5acb9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42040 does not affect version 0.18.1-tuxcare.7 of axios. not_affected \u2014 Version 0.18.1 is not affected by CVE-2026-42040. The vulnerable component `lib/helpers/AxiosURLSearchParams.js` does not exist in this version\u2014it was introduced in v1.0.0-alpha.1 (commit 934f390c), which postdates 0.18.1. The buildURL.js encode function that exists in 0.18.1 does not contain the reverse-encoding charMap entry ('\"%00\": \"\\x00\"') that causes the vulnerability. Testing confirms th...", "justification": "code_not_present" } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:c99cbdb4-8737-531f-b1a7-56deea0ac0db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42041 does not affect version 0.18.1-tuxcare.7 of axios. not_affected \u2014 Axios v0.18.0 is NOT AFFECTED by CVE-2026-42041. The vulnerable code pattern (lib/core/mergeConfig.js with mergeDirectKeys function using the 'in' operator) was introduced in v0.22.0 (September 2021), more than 3 years after v0.18.0 was released (February 2018). Version 0.18.0 uses a completely different architecture: utils.merge() with forEach() that employs Object.prototype.hasOwnProperty che...", "justification": "code_not_present" } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:2dd40e2c-fa32-5b6e-868f-6d55be003723", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42042 does not affect version 0.18.1-tuxcare.7 of axios. not_affected \u2014 The target version (axios 0.18.1) is NOT AFFECTED by CVE-2026-42042. The vulnerability concerns the `withXSRFToken` configuration property introduced in later axios versions. Version 0.18.1 predates this feature and uses a completely different XSRF token mechanism based on the `withCredentials` property. Exhaustive searches confirm `withXSRFToken` does not exist anywhere in the codebase, and th...", "justification": "code_not_present" } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:e323c666-024b-5a3c-a0cf-d8faafda7463", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42043 does not affect version 0.18.1-tuxcare.7 of axios. Target version 0.18.1 is not affected by CVE-2026-42043. The vulnerability describes an incomplete fix in lib/helpers/shouldBypassProxy.js (lines 1-3) where a hardcoded loopback address set recognizes only 127.0.0.1 instead of the full 127.0.0.0/8 subnet. Version 0.18.1 does not contain this file or any NO_PROXY handling logic. NO_PROXY support was first introduced in axios v0.19.0 (August 2018), and version 0.18.1 predates this feature entirely. The vulnerable code pattern is not present.", "justification": "code_not_present" } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:ec149679-c3f0-5ea7-a95c-f9dfa7b9973a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44486 does not affect version 0.18.1-tuxcare.7 of axios. already_fixed \u2014 The target repository already contains the fix for CVE-2026-44486 (Proxy-Authorization header leak on redirect). The fix was backported in commit 806a27b (also 3a086d9 in a backport branch), which implements the exact same defense as vendor commit afca61a070728e717203c2bc21e7b589b59b858b.", "justification": "code_not_present" } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:a39bad4e-2359-54ae-826b-6526498607e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44487 does not affect version 0.18.1-tuxcare.7 of axios. already_fixed \u2014 The target repository already contains the fix for CVE-2026-44487 (GHSA-j5f8-grm9-p9fc). The exact vendor commit afca61a070728e717203c2bc21e7b589b59b858b was backported in commit 806a27b as part of CVE-2024-28849 remediation on April 28, 2026. The defense mechanism strips stale Proxy-Authorization headers on redirect re-invocations, preventing credential leakage to unintended recipients.", "justification": "code_not_present" } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:5550bcce-a441-56b0-9271-e33a66497606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:072755d1-bf99-5e44-82fd-3f20b144d873", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-44492 does not affect version 0.18.1-tuxcare.7 of axios. not_affected \u2014 The target repository axios v0.18.1-tuxcare.2 does not implement NO_PROXY functionality at all. The vulnerability CVE-2026-44492 is specific to shouldBypassProxy.js (introduced in v1.15.0) which handles NO_PROXY hostname comparison. Since v0.18.1 predates this feature and has no hostname comparison or bypass logic, the vulnerability pattern cannot manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:42568c2c-f734-5305-a2be-6f8ef3a9a096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:39847841-586b-5607-b374-08e7c55fc4fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:bf6df9aa-2fa3-5921-b1b9-e6616d709082", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.18.1-tuxcare.7 of axios." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:b37bf127-e9ba-51d1-816b-c23bb2dd26a8", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.18.1-tuxcare.7 of axios." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:7d6fec23-3f75-5047-a504-e0824b146344", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.18.1-tuxcare.7." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ], "bom-ref": "urn:uuid:931d073f-7e81-5677-b32d-eed6627f56b0", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.18.1-tuxcare.7 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.18.1-tuxcare.7" } ] }