{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b0a4ee46-93e4-5ed4-a955-0b030aae3921", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@1.7.9-tuxcare.5", "type": "library", "bom-ref": "pkg:npm/axios@1.7.9-tuxcare.5", "version": "1.7.9-tuxcare.5", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-27152", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:1d942c89-b52a-5b26-a0d4-666ade2ac817", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-27152 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2025-58754", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:305c1dcb-d8b0-5613-93e1-bb5ee6fd2201", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-58754 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:3508c560-013a-5c20-8551-60b1afd1e389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-62718 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:703450f3-0839-5c26-b445-49623c50dc0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101902 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:9bec084c-7616-50cf-93af-0468d46a1f04", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-101904 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:34fba65f-52c0-5b04-b5fa-45d69616f815", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101908 does not affect version 1.7.9-tuxcare.5 of axios. not_affected \u2014 CVE-2026-101908 describes a prototype pollution gadget where passing user-provided `fetchOptions` as the second argument to fetch() allows inherited properties from `Object.prototype` to override sanitized request headers. The target (axios v1.7.9-tuxcare.4) does NOT have this vulnerable pattern. The target's fetch adapter calls `fetch(request)` with only one argument (line 272), never passing ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d9a11835-5c42-5068-be84-3bfd45d12286", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-25639 does not affect version 1.7.9-tuxcare.5 of axios. Version 1.7.9 is not vulnerable. Summary: The target repository (axios v1.7.9) is NOT vulnerable to CVE-2026-25639. The target uses Object.assign({}, config1, config2) for key iteration, which does not include __proto__ in Object.keys() results, preventing the DoS crash. The vulnerable code pattern was introduced later in v1.11.0 when the code was refactored to use the spread operator ({...config1, ...config2}). [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:86b7bc57-dc2f-5e98-826a-1b920ad59380", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-40175 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:415cd251-b04e-521a-be90-cad23a33abd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42033 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:8baecbed-eaa6-58dc-ad05-3d247a80d602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42034 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:e6af6234-47a3-5932-acc6-6f91e7e54003", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42035 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:9408b7d6-89e7-58a5-b046-934137438202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42036 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:8b57ce7f-4f27-5464-bbd0-cf27f546f79b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42037 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:eb6d0e14-33ee-50d3-81c1-3c241a64df7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42038 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:644bc3e0-9c97-5d3b-98f5-0a7fec48d469", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42039 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:89e6243e-4a5c-5d26-8283-0e7477fedadc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42040 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:22f4a5e8-7b96-53e8-82e6-692101824391", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42041 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:63197539-757d-5271-b74c-77dae5d58120", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42042 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:1ea1d49c-c620-5769-8e18-51be0b9f3d5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-42043 does not affect version 1.7.9-tuxcare.5 of axios. Version 1.7.9 is not vulnerable. Summary: The target version (axios v1.7.9) is NOT vulnerable to CVE-2026-42043 because the vulnerable shouldBypassProxy feature does not exist in this version. The target uses the external 'proxy-from-env' package for proxy handling, whereas the vulnerability exists in axios's own shouldBypassProxy implementation that was only introduced in version 1.15.0. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:631909f2-9469-5c0d-a614-be8845e8843f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42044 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:f1e73256-e759-5b72-9b14-6349205fe9a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-42264 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:f12b5b0d-d4aa-5f1d-8b91-f55534a7ef5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44486 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:2872fbbb-741b-5e13-b932-380ef0d54a5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44487 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:ca96ac3d-1c89-55d6-923d-011d540d5ab9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44488 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:03be1654-0058-59e4-a65c-61425b836ed1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44490 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44492", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:0a3818b2-11d0-5b19-96a2-82d7ba4bf245", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44492 affects version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:b49b4172-03ed-5b63-8f73-2639253246bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44494 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d65a0dab-64ea-501c-b184-699ff736f7b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44495 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:86771b11-c5de-557b-86a4-3be13d20ec79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-44496 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:caaad406-3ec4-52d7-9e23-72ec60d0dbeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67312 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:9dcaaf41-7a4c-5494-94c4-0dde588b3f4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67313 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:515f53c3-b5a6-5271-83cf-e5b913a25d07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67316 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:7974d3b5-0632-573c-99ba-f95b9a1a64a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67317 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:ab67b5f6-dbae-530d-b066-fc982a565594", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-67319 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-39j5-w47m-2gmv", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:98b4b00d-e68d-5542-86eb-7c30d8e4362d", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-42h9-826w-cgv3", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:5c30b1d8-7c8c-5e51-9b58-53c438c242b0", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-42h9-826w-cgv3 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-4ww2-rjh2-xpv9", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:deaf84e4-846a-54bf-a6bc-000cfe7bba32", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-6hqm-hm2v-3p2p", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:4d0073bf-92d2-5c19-babf-02f9f6fc2e79", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-7q8q-rj6j-mhjq", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:50669320-dcb3-5170-8571-06a20f80d5be", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-7q8q-rj6j-mhjq is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-9wx3-p993-35vp", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:fc9fb8e3-3106-5235-b3a7-68741331efd7", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-fq2j-3j99-rx65", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:d4b831b2-cc04-5b37-9114-859f56ad19e1", "analysis": { "state": "false_positive", "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.7.9-tuxcare.5." } }, { "id": "GHSA-jqh4-m9w3-8hp9", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:a4fdc8dc-ce95-51f1-b245-100946a9b6ba", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-jqh4-m9w3-8hp9 is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-mmx7-hfxf-jppx", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:a372f29d-65db-590c-bcee-3c648686cac5", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-mmx7-hfxf-jppx is fixed in version 1.7.9-tuxcare.5 of axios." } }, { "id": "GHSA-pmv8-rq9r-6j72", "affects": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ], "bom-ref": "urn:uuid:42b90e73-271a-5ea7-84c7-5e1b2c36c74b", "analysis": { "state": "resolved", "detail": "Vulnerability GHSA-pmv8-rq9r-6j72 is fixed in version 1.7.9-tuxcare.5 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@1.7.9-tuxcare.5" } ] }