{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:09d63b12-c17c-51f6-afbb-48edf3d4c8a9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@0.24.0-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/axios@0.24.0-tuxcare.5", "version": "0.24.0-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-45857", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:79e67a0c-bd49-5fa8-8734-b8dcb2a0f5d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-45857 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2024-39338", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:aea38684-fb44-546a-8317-14a80bb6bd0c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-39338 does not affect version 0.24.0-tuxcare.5 of axios. Target version 0.24.0 is NOT affected by CVE-2024-39338. The vulnerability exists in axios 1.7.2+ which uses the WHATWG URL constructor (new URL()) that resolves protocol-relative URLs. The target uses the legacy Node.js url.parse() API which does not treat '//attacker.com' as protocol-relative, breaking the SSRF attack chain. Testing confirms url.parse('//attacker.com:8888') returns hostname=null (treated as pathname), causing HTTP requests to default to localhost instead of the attacker's server.", "justification": "code_not_present" } }, { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:99989763-55b9-516c-b80f-2e2c4629a86c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:592d2018-30b1-5360-8cda-c1421c215143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:85ca225e-e302-59a6-8fa7-4cd8518ff1bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-25639 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:87ce10b7-6b75-5764-a17a-8d1f5da427af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:881fced5-5dba-5bd7-b218-24146ac2888d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:2ac8e41c-ed4a-56ff-a1db-82439707cc74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:94feb770-c981-5268-b17d-099f08d5fe44", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:0bce7e61-d9ff-535b-928d-a065e7fbe7f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:909a4f90-0ee5-5ae1-bb25-762f60177d3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d56dca01-9a13-598e-8142-83e503a7e434", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:644975a7-e678-50ad-840c-a20bc16aa7e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6abee605-22ee-5535-89eb-98bde5baca4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:3bfad05d-601c-506f-9e6c-59a3e2e6c6c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:da496cdd-7237-5310-af52-def641e6dfc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42043 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c165598b-8a10-58ad-821d-25dee657a781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6831b808-70cc-56af-9d8f-3a330b1754ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:d7d0f1a6-44bd-5e36-a05e-f43405c9b823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ed637827-0496-59c7-b319-9f3ff8fea707", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44492 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:893c4148-2241-5373-a1e5-c3cd31c96a34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:efa750f6-fc33-5fda-aaaa-3d6064f4ec5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:c24982dd-7b78-5822-bcb6-dce2dd5bcd30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6a7d70a4-5cdb-50a8-951e-d8fbff6a09e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 0.24.0-tuxcare.5 of axios." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:6375539a-0ce7-5a3e-8a24-2fcdce050076", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq affects version 0.24.0-tuxcare.5 of axios." } }, { "id": "GHSA-f2r5-pqh9-r8f8", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:566c763e-8121-5a16-8667-8dfe52690cb8", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-f2r5-pqh9-r8f8 is a false positive for axios 0.24.0-tuxcare.5." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ], "bom-ref": "urn:uuid:ca80c3ce-5d45-54e4-899a-6af7ff414a77", "analysis": { "state": "exploitable", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx affects version 0.24.0-tuxcare.5 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@0.24.0-tuxcare.5" } ] }