{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:9bfb36d6-0246-5ba9-aa66-cf60d6a010d3",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "axios",
      "purl": "pkg:npm/axios@0.19.0",
      "type": "library",
      "bom-ref": "pkg:npm/axios@0.19.0",
      "version": "0.19.0",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2020-28168",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:fcc168a3-9fc6-5ed3-8db8-bf2abc5005bb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-28168 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2021-3749",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:61e6ea37-0413-5a06-b271-21bd06d5f03c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-3749 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2023-45857",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:92d8c74e-50a7-5a92-b892-ddc653ed7a46",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-45857 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2025-27152",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:1f9da295-2092-5f24-a6f4-0732aaa05a69",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-27152 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2025-62718",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:0f0761c1-d59d-579b-adf6-3d16a2c63713",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-62718 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-25639",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:1b88e55c-072a-5a17-8570-ef23f685d4b6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25639 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-40175",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:9d281753-4a7f-5670-a2b7-0b5004d9559d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40175 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42033",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:ce8fc507-9253-5959-8442-6d5397efe460",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42033 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42034",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:66655935-8e00-58c5-9b06-3ed885413927",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42034 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42035",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:14145e8b-3e22-58d5-b01e-4895524eac19",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42035 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42036",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:89f9bfe0-f7d5-5eee-ac2c-a80a55ef5d64",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42036 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42038",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:f75dd7d8-1f10-579a-ba39-3256028425b0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42038 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42039",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:7b3f32b4-ed10-5d78-b12b-e4767a87152d",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42039 does not affect version 0.19.0 of axios. not_affected \u2014 Axios 0.19.0 is NOT affected by CVE-2026-42039. The vulnerable component (lib/helpers/toFormData.js with its unbounded recursive build() function) does not exist in this version. The file was introduced in v0.25.0, which was released after 0.19.0. In 0.19.0, nested objects are serialized using native JSON.stringify() rather than a custom recursive walker, so the specific vulnerability described...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42040",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:f443ec8b-7389-5d7d-9559-b39a97b77e76",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42040 does not affect version 0.19.0 of axios. not_affected \u2014 Target axios v0.19.0 is not affected by CVE-2026-42040. The vulnerable component lib/helpers/AxiosURLSearchParams.js does not exist in this version. The AxiosURLSearchParams feature (containing the null byte reverse-encoding vulnerability) was introduced in axios v0.28.0, which is 9 minor versions after the target. Version 0.19.0 uses only buildURL.js for URL encoding, which does not contain th...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42041",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:5a80ba5a-7f79-549b-aa62-6e26e942f6a1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42041 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-42042",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:ec8638f1-dcad-521d-aef4-f7126267ce40",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42042 does not affect version 0.19.0 of axios. not_affected \u2014 Version 0.19.0 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option introduced in later versions of axios. Version 0.19.0 predates this feature and does not contain the vulnerable code path. Exhaustive searches confirm that `withXSRFToken` does not exist anywhere in this version - neither in source code, documentation, nor tests. The CVE explicit...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42043",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:d67b0a18-4b3b-5f6a-b5ee-43fb451a9696",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42043 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44486",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:f0ba51b9-83c3-5f70-9d0a-e97cc3e44fdc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44486 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44487",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:536c6a6c-a1e2-51eb-8484-224d037e60a4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44487 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44490",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:9302f0b0-a4d1-54f1-a6f8-bca0648c38cb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44490 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44492",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:a070e1c7-7c84-504f-8f29-c34f5c5173bf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44492 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44495",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:48e245fd-0abc-5f85-bcff-938c42ff9484",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44495 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-44496",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:686f7e8f-8fad-5430-bccd-568c811aa424",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44496 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-67316",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:a0334bb9-083f-5ffd-b9e9-49517bde4d7f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67316 affects version 0.19.0 of axios."
      }
    },
    {
      "id": "CVE-2026-67319",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.19.0"
        }
      ],
      "bom-ref": "urn:uuid:c755fb19-7bcb-5032-be36-33060adb0eeb",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67319 affects version 0.19.0 of axios."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@0.19.0"
    }
  ]
}