{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:e127bfd6-b1f7-5874-9bb2-fa4773c6a08b",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "axios",
      "purl": "pkg:npm/axios@1.13.2-tuxcare.1",
      "type": "library",
      "bom-ref": "pkg:npm/axios@1.13.2-tuxcare.1",
      "version": "1.13.2-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "axios",
            "purl": "pkg:npm/axios@1.13.2",
            "type": "library",
            "version": "1.13.2"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2025-62718",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:add9e386-6f52-51df-a376-e5374b1dbae2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-62718 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-101898",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0e69743b-cd12-5978-b8cc-d350639a4200",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101898 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-101900",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0fabd3d4-6865-50db-ad0b-cb5a472a7667",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-101900 does not affect version 1.13.2-tuxcare.1 of axios. not_affected \u2014 Target version 1.13.2 is not affected by CVE-2026-101900. While the code calls data.getHeaders() without using getSafeProp (the vulnerable pattern), it includes an upstream-provided allowlist defense in resolveConfig.js (lines 33-38) that filters headers to only allow 'content-type' and 'content-length', preventing arbitrary header injection. This defense was introduced in upstream commit a9f47...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-101901",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:8b9b82b9-28f2-51db-ae76-106b68b0a469",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101901 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-101902",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cdd7d7df-348e-5871-96f8-53ac6a56f022",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101902 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-101904",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:17eb954b-c069-5bfb-8a2f-163ebd2e7997",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101904 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-101908",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c0f020c2-1f3e-598f-99ab-252b8f0e6413",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-101908 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-25639",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5e71c9b2-9006-53bd-865e-65a7545923aa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-25639 is fixed in version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-40175",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2b83013b-ba4f-5d05-9ddb-8eff0ed3c94e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-40175 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42033",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:46202077-ac76-586b-b350-24af1d3096f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42033 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42034",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:60d37690-f3c4-54f5-8d14-a45e7b058277",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42034 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42035",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cbdb8995-fa5e-5497-b096-4c9c41fc26fa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42035 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42036",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4c30094a-b3de-58bb-88d5-7ec7a4b68102",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42036 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42037",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f4c1c004-f820-54dc-b2a2-83e35e152302",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42037 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42038",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4430b8d8-f98f-5c68-8f22-ca01b0f33fe7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42038 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42039",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:137fe7c3-939f-5caa-88cb-0f143b73e23d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42039 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42040",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:30a350e1-c958-5854-8549-0e90d666b076",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42040 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42041",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:97d3a489-e5dd-5be6-83ae-cec91cf22138",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42041 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42042",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:012f3d61-99d0-58d4-86cb-f38704a101d5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42042 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42043",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4c321c29-a350-5690-9f17-b34926556b9e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42043 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42044",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:55c445d7-dc51-585b-95f0-8f63b6b7fcfc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42044 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-42264",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:daa9226e-2261-5cd6-990b-c3d4f116a1db",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-42264 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44486",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:690e61e0-20e3-53c8-9527-3b0f942d4c0c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44486 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44487",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3c353dd6-3620-5af5-9ba7-f0bd54d1ddde",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44487 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44488",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:e7bf5001-f174-5e0d-95d3-765aa52e8bc2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44488 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44490",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f317a42c-a8a1-51da-afb3-42d561a82f5f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44490 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44494",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:7a84b6e8-0305-5947-afb6-ebe3d4525a52",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44494 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44495",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:bd15705a-c7be-5d2e-80a6-b925115082ac",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44495 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-44496",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f3d5fd26-1553-5750-ac7b-fc4ae2f4b92e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-44496 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67312",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f7089cc5-fd60-5e13-99b9-fb1211fcece8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67312 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67313",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:32f50f5e-3887-5b71-a9b0-3a7123dfddf4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67313 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67316",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:d9f288d6-eea5-59df-91b8-67fb68426509",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67316 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67317",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0275eb06-8915-5b2c-9d10-545c9c3b72ec",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67317 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67318",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6867fcdd-e6b6-549e-a870-10a3ec36262a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67318 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "CVE-2026-67319",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cebf0f54-67af-559f-8042-a0bb66209d58",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-67319 affects version 1.13.2-tuxcare.1 of axios."
      }
    },
    {
      "id": "GHSA-39j5-w47m-2gmv",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:45bfc8c0-e11c-5205-bf80-968ddcd9520b",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-39j5-w47m-2gmv is a false positive for axios 1.13.2-tuxcare.1."
      }
    },
    {
      "id": "GHSA-4ww2-rjh2-xpv9",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:17c29f1e-d8d4-510f-8550-ce577c4973b0",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-4ww2-rjh2-xpv9 is a false positive for axios 1.13.2-tuxcare.1."
      }
    },
    {
      "id": "GHSA-6hqm-hm2v-3p2p",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f6f7c02f-bba2-5bd5-bfd9-9ad5c7f0198a",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-6hqm-hm2v-3p2p is a false positive for axios 1.13.2-tuxcare.1."
      }
    },
    {
      "id": "GHSA-9wx3-p993-35vp",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:693d1eb3-cd52-5b4e-a843-a771cfb9a2cb",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-9wx3-p993-35vp is a false positive for axios 1.13.2-tuxcare.1."
      }
    },
    {
      "id": "GHSA-fq2j-3j99-rx65",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ce0fe4f1-7c1f-5071-a47b-440fb4174c2f",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-fq2j-3j99-rx65 is a false positive for axios 1.13.2-tuxcare.1."
      }
    },
    {
      "id": "GHSA-fqj3-h9pc-443h",
      "affects": [
        {
          "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:cad52550-3c5a-52a9-b38d-15b49be1eb27",
      "analysis": {
        "state": "false_positive",
        "detail": "Vulnerability GHSA-fqj3-h9pc-443h is a false positive for axios 1.13.2-tuxcare.1."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:npm/axios@1.13.2-tuxcare.1"
    }
  ]
}