{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:d947cc4a-6cac-58df-a305-8f5f604a5d35",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "axios",
      "purl": "pkg:npm/axios@0.21.2-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/axios@0.21.2-tuxcare.1",
      "version": "0.21.2-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "axios",
            "purl": "pkg:npm/axios@0.21.2",
            "type": "library",
            "version": "0.21.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-45857",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:83f97857-8e54-5a48-919d-4dbd8a5c3655",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-45857 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2025-27152",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:58a2840e-61e6-5409-b386-2a6abddffacf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-27152 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2025-62718",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:763a678f-73ab-5074-b012-939c6e5e022c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-62718 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-25639",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2f935a65-f2f8-54d8-8b5c-535ff7198bf0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25639 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-40175",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b0181ff3-3226-53bf-9fee-232ef7c18527",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40175 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42033",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e696a469-74ab-5997-a4ce-f98c96b2fc35",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42033 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42034",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a0350a83-4ddc-53e9-94c3-0d02433440ce",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42034 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42035",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2170421b-9068-5aea-b4e4-611edc65291c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42035 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42036",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c8207325-d2ca-5a12-9d27-f7790bb12004",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42036 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42038",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:dbe75858-f726-54d9-8fd5-99a12395078e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42038 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42039",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9975a7af-ba27-519a-a00b-71b6d0aaab0e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42039 does not affect version 0.21.2-tuxcare.1 of axios. not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-42040",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:df333512-5bd5-57b8-b77b-edeb732f0329",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42040 does not affect version 0.21.2-tuxcare.1 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-42041",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:b3ceec00-deb5-5345-b3d8-0429117b92f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42041 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42042",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0afbacbe-a84b-52f3-9b4f-49cae47be55a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42042 does not affect version 0.21.2-tuxcare.1 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42043",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ed31c991-463d-5202-8974-b4fa6e1f5857",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42043 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44486",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ee6ce544-fec2-5ab6-82da-dd7575b2190e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44486 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44487",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a9515bb8-708b-50d5-badb-e76a612fa038",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44487 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44490",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:820cf7b9-c997-59de-98e4-ddda9f713d7e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44492",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2d5effb2-8555-5c4e-b1f1-4fcd7e10baa7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44492 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44495",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0888b100-55bf-53cb-ba4b-d36eabada6a5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44495 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44496",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:73122c9e-de01-5a71-9bd7-cb556a6cbf11",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44496 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67316",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6ee18bea-673c-5d1d-ab41-463d10158935",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67316 affects version 0.21.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67319",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:085e41c9-8da3-50fe-8cf7-7b10e0bb7ab2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67319 affects version 0.21.2-tuxcare.1 of axios."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@0.21.2-tuxcare.1"
    }
  ]
}