{
  "@id": "urn:uuid:9f14a0a1-00d5-481d-be60-2525bd73ef38",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 18,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-16T15:20:16.426705+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:35:07.434363+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "action_statement": "Vulnerability CVE-2023-45857 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:35:07.434363+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "action_statement": "Vulnerability CVE-2025-27152 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:30:28.806949+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "action_statement": "Vulnerability CVE-2025-62718 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:29:00.241105+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "action_statement": "Vulnerability CVE-2026-25639 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:28:00.245689+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "action_statement": "Vulnerability CVE-2026-40175 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:32:00.181294+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "action_statement": "Vulnerability CVE-2026-42033 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:31:00.195387+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "action_statement": "Vulnerability CVE-2026-42034 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:32:00.181294+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "action_statement": "Vulnerability CVE-2026-42035 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:31:00.195387+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "action_statement": "Vulnerability CVE-2026-42036 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:30:28.806949+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "action_statement": "Vulnerability CVE-2026-42038 affects version 0.21.2 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-16T11:42:03.565201+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 does not affect version 0.21.2 of axios. not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "impact_statement": "not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-16T12:41:00.266160+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 does not affect version 0.21.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "impact_statement": "not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:33:00.271638+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "action_statement": "Vulnerability CVE-2026-42041 affects version 0.21.2 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-16T12:23:00.164994+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 does not affect version 0.21.2 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "impact_statement": "not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:34:00.174513+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "action_statement": "Vulnerability CVE-2026-42043 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:27:00.137143+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:26:00.261932+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.1.",
      "vulnerability": {
        "name": "CVE-2026-44490"
      },
      "action_statement": "Vulnerability CVE-2026-44490 affects version 0.21.2 of axios, and is fixed in 0.21.2-tuxcare.1."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:23:00.585347+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "action_statement": "Vulnerability CVE-2026-44492 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:24:00.141259+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:28:00.245689+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:23:00.585347+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 0.21.2 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2"
          }
        }
      ],
      "timestamp": "2026-10-15T13:21:00.158031+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 0.21.2 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 0.21.2 of axios."
    }
  ]
}