{
  "@id": "urn:uuid:1e133d6b-ffdd-4a6f-ac40-eb2be6731169",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 1,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-16T15:20:16.426705+00:00",
  "statements": [
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2023-45857 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2023-45857"
      },
      "action_statement": "Vulnerability CVE-2023-45857 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2025-27152 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2025-27152"
      },
      "action_statement": "Vulnerability CVE-2025-27152 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2025-62718 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2025-62718"
      },
      "action_statement": "Vulnerability CVE-2025-62718 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-25639 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-25639"
      },
      "action_statement": "Vulnerability CVE-2026-25639 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-40175 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-40175"
      },
      "action_statement": "Vulnerability CVE-2026-40175 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42033 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42033"
      },
      "action_statement": "Vulnerability CVE-2026-42033 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42034 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42034"
      },
      "action_statement": "Vulnerability CVE-2026-42034 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42035 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42035"
      },
      "action_statement": "Vulnerability CVE-2026-42035 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42036 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42036"
      },
      "action_statement": "Vulnerability CVE-2026-42036 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42038 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42038"
      },
      "action_statement": "Vulnerability CVE-2026-42038 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42039 does not affect version 0.21.2-tuxcare.1 of axios. not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-42039"
      },
      "impact_statement": "not_affected \u2014 axios v0.21.2 is not affected by CVE-2026-42039. The vulnerability exists in lib/helpers/toFormData.js's recursive build() function, which was introduced in version 1.x. Version 0.21.2 uses JSON.stringify() for request data serialization and utils.forEach() + JSON.stringify() for params serialization, neither of which exhibit unbounded recursion. The vulnerable code path does not exist in this ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42040 does not affect version 0.21.2-tuxcare.1 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-42040"
      },
      "impact_statement": "not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42040. The vulnerable file `lib/helpers/AxiosURLSearchParams.js` does not exist in this version - it was introduced in version 1.2.0-alpha.1 (commit 934f390c, 2022-05-25), which postdates the 0.21.2 release. URL parameter encoding in v0.21.2 uses `buildURL.js`'s encode() function, which safely preserves null bytes as `%00` without reversing them to raw..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42041 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42041"
      },
      "action_statement": "Vulnerability CVE-2026-42041 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42042 does not affect version 0.21.2-tuxcare.1 of axios. not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-42042"
      },
      "impact_statement": "not_affected \u2014 Version 0.21.2 is not affected by CVE-2026-42042. The vulnerability targets the `withXSRFToken` configuration option, which does not exist in this version. The feature was introduced in commit cff99677 (2023-11-14) as a replacement for the older `withCredentials`-based XSRF behavior that was affected by CVE-2023-45857. Version 0.21.2 predates the introduction of `withXSRFToken` and uses the ear..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-42043 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-42043"
      },
      "action_statement": "Vulnerability CVE-2026-42043 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-44486 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44486"
      },
      "action_statement": "Vulnerability CVE-2026-44486 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-44487 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44487"
      },
      "action_statement": "Vulnerability CVE-2026-44487 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-44490 is fixed in version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44490"
      }
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-44492 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44492"
      },
      "action_statement": "Vulnerability CVE-2026-44492 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-44495 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44495"
      },
      "action_statement": "Vulnerability CVE-2026-44495 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-44496 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-44496"
      },
      "action_statement": "Vulnerability CVE-2026-44496 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-67316 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67316"
      },
      "action_statement": "Vulnerability CVE-2026-67316 affects version 0.21.2-tuxcare.1 of axios."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/axios@0.21.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/axios@0.21.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-16T15:20:16.426705+00:00",
      "status_notes": "Vulnerability CVE-2026-67319 affects version 0.21.2-tuxcare.1 of axios.",
      "vulnerability": {
        "name": "CVE-2026-67319"
      },
      "action_statement": "Vulnerability CVE-2026-67319 affects version 0.21.2-tuxcare.1 of axios."
    }
  ]
}