{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e439bf35-4a84-5540-b3d8-aa5c0751c606",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "axios",
      "purl": "pkg:npm/axios@0.21.2",
      "type": "library",
      "bom-ref": "pkg:npm/axios@0.21.2",
      "version": "0.21.2",
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2023-45857",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:3dcfae17-25ae-5108-94d8-01bd16f0af4a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-45857 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2025-27152",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:010ab67e-ea0b-5142-9f71-861add2bca13",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-27152 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2025-62718",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:2f608eca-d3ba-5a89-b82e-a5cacc30b32d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-62718 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-25639",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:09e5d9d0-e089-5cd8-a1ee-ed9eca1b6b68",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-25639 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-40175",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:46c3e5d6-e31c-59fe-ab02-4fe9f5e91e7d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40175 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-42033",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:5f6278c3-55a8-5a68-a515-76d083eee99d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42033 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-42034",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:8ae97579-c8c4-5cd1-951b-1b6e41fc793d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42034 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-42035",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:50ac5542-4232-5226-8c04-a5a652d4f9de",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42035 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-42036",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:97f789b1-6214-58a8-80fe-693b2d35160f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42036 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-42038",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:4f91c226-1769-5d64-aa11-141989c56329",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42038 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-42039",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:e44471d9-4ead-5e27-b7a4-3d4b778e4519",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42039 does not affect version 0.21.2 of axios. not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-42040",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:04e8bfc8-46d0-5ac7-814f-be0e70d48643",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42040 does not affect version 0.21.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2026-42041",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:6a88fb17-ea9e-5273-9268-0a9647d278e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42041 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-42042",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:85ffb203-af74-51fe-9b8e-e8b48d86c945",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-42042 does not affect version 0.21.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-42043",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:026f42f8-cac1-58d9-830d-ea4f41740988",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42043 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-44486",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:56faab86-6068-581e-8593-7d1e170aecf3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44486 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-44487",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:691ec47f-7b00-5ce9-a12e-25da77adc94b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44487 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-44490",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:d859ed7f-c52f-5d24-9d21-33c38be8e8ad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44490 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.1."
      }
    },
    {
      "id": "CVE-2026-44492",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:04d9f62c-a5a3-5228-85f6-07c3e3b14ac7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44492 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-44495",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:166420c7-94fb-5609-8950-3b51d65a9e90",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44495 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-44496",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:22aa7972-2cab-56c3-9827-43d721a5b352",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44496 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-67316",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:b9ab9196-22c3-5439-bd04-f0a896430618",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67316 affects version 0.21.2 of axios."
      }
    },
    {
      "id": "CVE-2026-67319",
      "affects": [
        {
          "ref": "pkg:npm/axios@0.21.2"
        }
      ],
      "bom-ref": "urn:uuid:a029ab52-412d-584c-b4b2-0f3b2ec05b2b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67319 affects version 0.21.2 of axios."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@0.21.2"
    }
  ]
}