ROOT-APP-NPM-CVE-2026-67320 CVE-2026-67320 in axios - Patched by Root

Root has patched CVE-2026-67320 in the axios package for Root:npm. Multiple fixed versions available...

CVE-2026-67320 vulnerabilities

Vulnerabilities for packages: jitsucom-jitsu, wazuh-dashboard-fips, langfuse, redisinsight, wazuh-dashboard, azurite, awx, kibana, semaphore, librechat, opensearch-dashboards-fips, gitlab-rails-ce-fips, gitlab-rails-ce, langfuse-fips, kubeflow-centraldashboard, nextcloud-server, lerna,...

CVE-2026-67320 vulnerabilities

Vulnerabilities for packages: opensearch-dashboards, nextcloud-server, lerna, jitsucom-jitsu, langfuse, kubeflow-centraldashboard, prism...

Linux Distros Unpatched Vulnerability : CVE-2026-67320

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - axios in a Node.js deployment using the HTTP adapter can route requests through an attacker-controlled proxy. axios hardens merged request configuration by...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +537 more potentially affected by CVE-2026-67320 via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-67320 Source advisory: MEND:CVE-2026-67320...

-fides-amor-et-lux (1.0.0), 0xpay-cc-sdk (>=0.0.8, <=0.1.0) +17231 more potentially affected by CVE-2026-42264 +1 more via axios (>=1.0.0, <=1.17.0)

axios NPM version =1.0.0, =0.0.8, =1.0.54, =0.1.0, =1.0.1, =1.0.0, =0.0.1, =0.0.1, =0.1.2, =0.0.1, =0.0.1, =0.0.1, =1.1.0-beta.18 and more Source cves: CVE-2026-42264, CVE-2026-67320 Source advisory: SNYK:JS-AXIOS-18065351...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +537 more potentially affected by CVE-2026-42264 +1 more via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-42264, CVE-2026-67320 Source advisory: SNYK:JS-AXIOS-18065351...

123pancli (1.0.0), @142vip/axios (>=0.0.1-alpha.9, <=0.0.1-alpha.11) +2575 more potentially affected by CVE-2026-67320 via axios (>=1.15.2, <=1.17.0)

axios NPM version =1.15.2, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =0.1.0, =0.1.4 - @abhinav-dev/mcp-platform-kit 1.0.0 - @accelbyte/sdk 4.3.2 - @accelbyte/sdk-achievement 5.3.5 - @accelbyte/sdk-ams 5.3.5 - @accelbyte/sdk-audit 6.0.5 -...

@a-rt-works/auth0-deploy-cli (3.3.3), @acknow-srl/express-openid (>=1.0.0, <=1.0.1) +537 more potentially affected by CVE-2026-67320 via axios (>=0.31.1, <=0.32.0)

axios NPM version =0.31.1, =1.0.0, =0.0.1, =0.0.2, =1.3.2, =0.2.0, =0.0.2-beta.0, =2.0.14, =0.5.12, =1.0.0, =1.0.1, =32.0.0, =0.2.4, =0.3.0 and more Source cves: CVE-2026-67320 Source advisory: OSV:GHSA-GCFJ-64VW-6MP9...

com.alilitech:boot-plus-log (>=2.1.0, <=4.0.0), com.github.linyuzai:concept-plugin-spring-boot-starter (>=2.0.0, <=3.0.0) +8 more potentially affected by CVE-2026-42264 +1 more via org.webjars.npm:axios (>=1.1.3, <=1.7.2)

org.webjars.npm:axios MAVEN version =1.1.3, =2.1.0, =2.0.0, =1.0.3, =1.0.0, =2.1.1, =1.0.0, =1.0.0, =2.1.3, =2.0.0, =1.0.2, =1.0.9 Source cves: CVE-2026-42264, CVE-2026-67320 Source advisory: SNYK:JAVA-ORGWEBJARSNPM-18065352...

123pancli (1.0.0), @142vip/axios (>=0.0.1-alpha.9, <=0.0.1-alpha.11) +2575 more potentially affected by CVE-2026-67320 via axios (>=1.15.2, <=1.17.0)

axios NPM version =1.15.2, =0.0.1-alpha.9, =0.0.3-alpha.31, =0.0.1-alpha.29, =0.1.6-alpha.14, =0.0.1-alpha.20, =1.1.3-rc.0, =0.1.0, =0.1.4 - @abhinav-dev/mcp-platform-kit 1.0.0 - @accelbyte/sdk 4.3.2 - @accelbyte/sdk-achievement 5.3.5 - @accelbyte/sdk-ams 5.3.5 - @accelbyte/sdk-audit 6.0.5 -...