{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:56a4be7c-2648-5cd4-baab-4ab87475eab4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "axios", "purl": "pkg:npm/axios@1.13.2", "type": "library", "bom-ref": "pkg:npm/axios@1.13.2", "version": "1.13.2", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-62718", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:0caa05dc-c50e-5c43-b22e-c27628ca21f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-62718 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-101898", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:13b2371f-66c4-5084-9333-67201461aa85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101898 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-101900", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:ffa3e4af-4787-5643-9b6b-a1eeec363215", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-101900 does not affect version 1.13.2 of axios. not_affected \u2014 Target version 1.13.2 is not affected by CVE-2026-101900. While the code calls data.getHeaders() without using getSafeProp (the vulnerable pattern), it includes an upstream-provided allowlist defense in resolveConfig.js (lines 33-38) that filters headers to only allow 'content-type' and 'content-length', preventing arbitrary header injection. This defense was introduced in upstream commit a9f47...", "justification": "code_not_present" } }, { "id": "CVE-2026-101901", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:dae57e7c-0b2e-5c32-b3df-da44c58ee78c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101901 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-101902", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:3c9a4497-48c9-5972-97e2-9ff2928bf5fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101902 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-101904", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:1f657d98-cd7e-5254-aedd-823db947a82a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101904 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-101908", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:292da36a-02b0-5bb2-9ed5-3b649f03a0ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-101908 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-25639", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:75db8124-f247-5330-bc0b-dab41a6d5c3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-25639 affects version 1.13.2 of axios, and is fixed in 1.13.2-tuxcare.1." } }, { "id": "CVE-2026-40175", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:b2e88578-5d12-59c4-bddb-24803b9beecf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-40175 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42033", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:8c595bfb-b9fa-51dd-8cb8-7d19f63e3c15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42033 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42034", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:948f6f08-84bc-560a-9098-25163070bbff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42034 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42035", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:3527501c-aa56-5f43-b9b2-06c41548d8dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42035 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42036", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:b1369e1b-2450-53ca-871c-6541e1ea3586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42036 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42037", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:1879ddc4-c2f3-575b-aa81-2826d8988536", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42037 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42038", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:efdd57be-ca35-56a7-8a19-02ad2ee27501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42038 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42039", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:7a60da34-9945-592c-8f05-eccc582e849b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42039 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42040", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:72f95f32-aa72-5bf3-b6ec-88ad138bc18f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42040 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42041", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:2d946716-e030-522e-a235-005111cd1f4a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42041 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42042", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:a3f15429-1f5f-5bcb-a99f-805263ed9953", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42042 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42043", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:0c521c84-fbb4-560d-bdf5-2c2f50af8331", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42043 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42044", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:1f6918d8-0da0-5c83-8862-fa75682a10f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42044 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-42264", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:b2a34612-b322-5e4d-a614-4139f1f08340", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-42264 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-44486", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:e9f793ed-35f1-5bb3-9055-d023ed023d1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44486 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-44487", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:428131bf-75bc-5bd0-afe9-c5c8beccd2e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44487 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-44488", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:a7168582-c66f-59ed-bce1-d909ee358369", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44488 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-44490", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:0ed18205-c6f7-5b2b-ad9f-f5fca2b06d3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44490 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-44494", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:5f7923b2-6e5f-57b4-8f06-0acfcbf0c8fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44494 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-44495", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:ecb9e3ea-b486-58ec-b5be-33e1c76fbc60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44495 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-44496", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:f084bf6b-6816-5319-88c2-416c2cfa8d90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-44496 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-67312", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:d1599d54-8648-5a2f-8574-799769951f81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67312 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-67313", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:5439ac5e-a9e0-5dc0-a2e6-540e21240c5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67313 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-67316", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:624ca088-06b9-55ae-adad-961783df3a8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67316 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-67317", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:c1cd0b53-14cc-52e8-8418-2e192a5ab81c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67317 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-67318", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:8bc71bd4-49d4-57c7-8b6d-0aef39c65ce0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67318 affects version 1.13.2 of axios." } }, { "id": "CVE-2026-67319", "affects": [ { "ref": "pkg:npm/axios@1.13.2" } ], "bom-ref": "urn:uuid:92d2a167-ae33-567d-8ee6-ef4ec827adc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-67319 affects version 1.13.2 of axios." } } ], "dependencies": [ { "ref": "pkg:npm/axios@1.13.2" } ] }