{"id":"CVE-2025-66565","revision":null,"records":[{"revision":"a0724da8cd1f4be78140ae8d99e45ab7","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-66565","aliases":[],"title":"Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values","description":"Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID \"00000000-0000-0000-0000-000000000000\". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.","state":0,"publishedAt":"2025-12-09T01:47:58.43+00:00","modifiedAt":"2025-12-09T16:03:03.356+00:00","affected":[{"ecosystem":"Vendor product","name":"utils","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"gofiber\",\n                    \"product\": \"utils\",\n                    \"versions\": [\n                        {\n                            \"version\": \"github.com/gofiber/utils <= 1.2.0\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"github.com/gofiber/utils/v2 < 2.0.0-rc.4\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/gofiber/utils/security/advisories/GHSA-m98w-cqp3-qcqr","https://github.com/gofiber/utils/commit/6c6cf047032b9c8dff43d29f990b4b10e9b02d47"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-66565","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-66565","identifiers":["CVE-2025-66565"]},"retained":false,"historicalAffected":[]},{"revision":"487be5f2509c4a85af6313c554ab4d68","observedAt":"2026-11-11T04:33:46.167+00:00","statement":{"source":"euvd","id":"EUVD-2025-201791","aliases":["CVE-2025-66565","GHSA-m98w-cqp3-qcqr"],"title":"Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUI…","description":"Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID \"00000000-0000-0000-0000-000000000000\". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":9.3,"severity":null}],"references":["https://github.com/gofiber/utils/security/advisories/GHSA-m98w-cqp3-qcqr","https://github.com/gofiber/utils/commit/6c6cf047032b9c8dff43d29f990b4b10e9b02d47"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-201791","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 9, 2025, 1:47:58 AM","dateUpdated":"Dec 9, 2025, 4:03:03 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-201791","identifiers":["EUVD-2025-201791","CVE-2025-66565","GHSA-m98w-cqp3-qcqr"]},"retained":false,"historicalAffected":[]},{"revision":"6ebc30ccaf7d4094b1deb37e3e0928cd","observedAt":"2026-10-25T03:17:36.152+00:00","statement":{"source":"nvd","id":"CVE-2025-66565","aliases":[],"title":"Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUI…","description":"Fiber Utils is a collection of common functions created for Fiber. In versions 2.0.0-rc.3 and below, when the system's cryptographic random number generator (crypto/rand) fails, both functions silently fall back to returning predictable UUID values, including the zero UUID \"00000000-0000-0000-0000-000000000000\". The vulnerability occurs through two related but distinct failure paths, both ultimately caused by crypto/rand.Read() failures, compromising the security of all Fiber applications using these functions for security-critical operations. This issue is fixed in version 2.0.0-rc.4.","state":0,"publishedAt":"2025-12-09T16:18:21.097+00:00","modifiedAt":"2026-10-07T20:10:01.97+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8,"severity":"CRITICAL"}],"references":["https://github.com/gofiber/utils/commit/6c6cf047032b9c8dff43d29f990b4b10e9b02d47","https://github.com/gofiber/utils/security/advisories/GHSA-m98w-cqp3-qcqr"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-66565","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-252","CWE-331","CWE-338"],"productCriteria":["cpe:2.3:a:gofiber:utils:*:*:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta1:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta10:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta11:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta12:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta13:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta14:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta2:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta3:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta4:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta5:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta6:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta7:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta8:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:beta9:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:rc1:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:rc2:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:rc3:*:*:*:go:*:*","cpe:2.3:a:gofiber:utils:2.0.0:rc4:*:*:*:go:*:*"],"sourceDates":{"published":"2025-12-09T16:18:21.097","lastModified":"2026-10-07T20:10:01.970"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-66565","identifiers":["CVE-2025-66565"]},"retained":false,"historicalAffected":[]},{"revision":"af9b263760f44a4f8c224765b94db64f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-m98w-cqp3-qcqr","aliases":["CVE-2025-66565","GO-2025-4208"],"title":"Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values","description":"## Summary\n\nCritical security vulnerabilities exist in both the `UUIDv4()` and `UUID()` functions of the `github.com/gofiber/utils` package. When the system's cryptographic random number generator (`crypto/rand`) fails, both functions silently fall back to returning predictable UUID values, the zero UUID `\"00000000-0000-0000-0000-000000000000\"`. This compromises the security of all Fiber applications using these functions for security-critical operations on **Go versions prior to 1.24**.\n\n**Both functions are vulnerable to the same root cause (`crypto/rand` failure):**\n\n* `UUIDv4()`: Indirect vulnerability through `uuid.NewRandom()` → `crypto/rand.Read()` → fallback to `UUID()`\n* `UUID()`: Direct vulnerability through `crypto/rand.Read(uuidSeed[:])` → silent zero UUID return\n\n> **Note:** Go 1.24 and later panics on `crypto/rand` `Read()` failures, mitigating this vulnerability. Applications running on Go 1.24+ are not affected by the silent fallback behavior.\n\n---\n\n## Vulnerability Details\n\n### Affected Functions\n\n* **Package**: `github.com/gofiber/utils`\n* **Functions**: `UUIDv4()` and `UUID()`\n* **Return Type**: `string` (both functions)\n* **Locations**: `common.go:93-99` (UUIDv4), `common.go:60-89` (UUID)\n\n### Technical Description\n\nThe vulnerability occurs through two related but distinct failure paths, both ultimately caused by `crypto/rand.Read()` failures on Go < 1.24:\n\n#### Primary Path: UUIDv4() Vulnerability\n\n1. `UUIDv4()` calls `google/uuid.NewRandom()` which internally uses `crypto/rand.Read()`\n2. If `uuid.NewRandom()` fails, `UUIDv4()` falls back to the internal `UUID()` function\n3. **No error is returned to the application** - silent security failure occurs\n\n#### Secondary Path: UUID() Vulnerability\n\n1. `UUID()` directly calls `crypto/rand.Read(uuidSeed[:])` to seed its internal state\n2. If seeding fails, `UUID()` **silently fails** and returns the zero UUID `\"00000000-0000-0000-0000-000000000000\"`\n3. Applications receive predictable UUIDs with no indication of the security failure\n\n---\n\n### Code Analysis\n\n#### UUIDv4() Vulnerability Path\n\n```go\nfunc UUIDv4() string {\n\ttoken, err := uuid.NewRandom()  // Uses crypto/rand.Read() internally\n\tif err != nil {\n\t\treturn UUID()  // Dangerous fallback - no error returned to application\n\t}\n\treturn token.String()\n}\n```\n\n#### UUID() Vulnerability Path\n\n```go\nfunc UUID() string {\n\tuuidSetup.Do(func() {\n\t\tif _, err := rand.Read(uuidSeed[:]); err != nil {  // Direct crypto/rand.Read() call\n\t\t\treturn  // Silent failure - no seeding, uuidCounter remains 0\n\t\t}\n\t\tuuidCounter = binary.LittleEndian.Uint64(uuidSeed[:8])\n\t})\n\tif atomic.LoadUint64(&uuidCounter) <= 0 {\n\t\treturn \"00000000-0000-0000-0000-000000000000\"  // Zero UUID returned silently\n\t}\n\t// ... generate UUID from counter\n}\n```\n\n**Root Cause:** Both vulnerabilities stem from `crypto/rand.Read()` failures, occurring through different code paths with the same dangerous silent fallback behavior.\n\n---\n\n## Security Impact\n\n### Severity: CRITICAL\n\nThis issue is especially severe because many Fiber middleware packages (session, CSRF, auth, rate-limit, request-ID, etc.) default to `utils.UUIDv4()` for generating security-sensitive identifiers. A failure in `crypto/rand` would cause **every generated identifier across the entire application** to collapse to a single predictable value (the zero UUID), resulting in:\n\n* **Session fixation / universal session hijack**\n* **CSRF token predictability and bypass**\n* **Authentication token replay**\n* **Global identifier collisions leading to severe application breakage**\n* **Potential application-wide DoS** due to every request using the same “unique” key, causing cache overwrites, session stomping, corrupted internal maps, and loss of isolation across all users\n\n---\n\n### Attack Scenario\n\nWhile **entropy exhaustion is extremely rare on modern Linux systems**, *RNG access failures* (e.g., restricted `/dev/random` or `/dev/urandom` access, broken container environments, sandbox restrictions, misconfigured VMs, or FIPS-mode RNG failures) are realistic. In these scenarios on **Go < 1.24**, `crypto/rand` may return errors immediately — triggering the vulnerable fallback paths.\n\nOn **Go 1.24+**, `crypto/rand` `Read()` panics on failure, mitigating the silent-zero fallback issue.\n\n---\n\n### Proof of Concept\n\n1. `uuid.NewRandom()` fails (indirect `crypto/rand.Read()` failure)\n2. `UUIDv4()` calls `UUID()` as fallback with no error returned\n3. `UUID()` seeding fails directly via `crypto/rand.Read(uuidSeed[:])`\n4. Zero UUID `\"00000000-0000-0000-0000-000000000000\"` is returned silently\n5. No error is propagated to the application from either function\n\n---\n\n## Affected Versions\n\n* All versions of `github.com/gofiber/utils` containing the `UUIDv4()` or `UUID()` functions\n* Applications using Fiber middleware that depend on `UUIDv4()` or `UUID` for security\n* **Only applicable to Go < 1.24**; Go 1.24+ panics/block on `crypto/rand` `Read()` failures and is not affected\n\n---\n\n## Mitigation\n\n### Immediate Workaround\n\nReplace usage of `utils.UUIDv4()` with `uuid.New()` or wait for fix:\n\n```go\nsessionID := uuid.New()\n```\n\n### Recommended Fix\n\nModify `utils.UUIDv4()` and `utils.UUID()` to fail explicitly when cryptographic randomness is unavailable:\n\n```go\nfunc UUIDv4() string {\n\ttoken, err := uuid.NewRandom()\n\tif err != nil {\n\t\tpanic(fmt.Sprintf(\"utils: failed to generate secure UUID: %v\", err))\n\t}\n\treturn token.String()\n}\n\nfunc UUID() string {\n    uuidSetup.Do(func() {\n        if _, err := rand.Read(uuidSeed[:]); err != nil {\n            panic(fmt.Sprintf(\"utils: failed to seed UUID generator: %v\", err))\n        }\n        uuidCounter = binary.LittleEndian.Uint64(uuidSeed[:8])\n    })\n    if atomic.LoadUint64(&uuidCounter) <= 0 {\n        panic(\"utils: UUID generator not properly seeded\")\n    }\n    // ... generate UUID from counter\n}\n```\n\n---\n\n## Detection\n\nApplications can detect if they're affected by:\n\n1. Checking if they use `github.com/gofiber/utils`\n2. Searching for `UUIDv4()` and `UUID()` usage in security-critical code paths\n3. Reviewing Fiber middleware configurations that rely on defaults of `UUIDv4()` for security identifiers\n\n---\n\n## References\n\n* **Package Repository**: [https://github.com/gofiber/utils](https://github.com/gofiber/utils)\n* **Fiber Framework**: [https://github.com/gofiber/fiber](https://github.com/gofiber/fiber)\n* **Google UUID Library**: [https://github.com/google/uuid](https://github.com/google/uuid)\n* Golang `crypto/rand` behavior changes: [golang/go#66821](https://github.com/golang/go/issues/66821), [Go 1.25.5 source](https://cs.opensource.google/go/go/+/refs/tags/go1.25.5:src/crypto/rand/rand.go;l=80)\n\n---\n\n## Contact\n\nReported by: [@sixcolors](https://github.com/sixcolors)\n\n---\n\n## Classification\n\n* **OWASP**: A02:2021 - Cryptographic Failures\n* **Impact**: Complete compromise of application security model on Go < 1.24\n* **Exploitability**: Medium (requires entropy failure)\n* **Scope**: All Fiber applications using affected middleware on Go < 1.24","state":0,"publishedAt":"2025-12-08T17:57:26+00:00","modifiedAt":"2025-12-15T19:56:09.002075+00:00","affected":[{"ecosystem":"Go","name":"github.com/gofiber/utils/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.0-rc.4"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gofiber/utils","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.2.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/gofiber/utils/security/advisories/GHSA-m98w-cqp3-qcqr","https://nvd.nist.gov/vuln/detail/CVE-2025-66565","https://github.com/gofiber/utils/commit/6c6cf047032b9c8dff43d29f990b4b10e9b02d47","https://github.com/gofiber/utils"],"sourceUrl":"https://github.com/advisories/GHSA-m98w-cqp3-qcqr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-m98w-cqp3-qcqr","identifiers":["GHSA-m98w-cqp3-qcqr","CVE-2025-66565","GO-2025-4208"]},"retained":false,"historicalAffected":[]},{"revision":"c37416b3d6c24d8d9417dc916b00bb8f","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2025-4208","aliases":["CVE-2025-66565","GHSA-m98w-cqp3-qcqr"],"title":"Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values in github.com/gofiber/utils","description":"Fiber Utils UUIDv4 and UUID Silent Fallback to Predictable Values in github.com/gofiber/utils","state":0,"publishedAt":"2025-12-15T19:37:35+00:00","modifiedAt":"2026-03-03T04:57:45.990034+00:00","affected":[{"ecosystem":"Go","name":"github.com/gofiber/utils","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.2.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/gofiber/utils/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.0.0-rc.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/gofiber/utils/security/advisories/GHSA-m98w-cqp3-qcqr","https://nvd.nist.gov/vuln/detail/CVE-2025-66565","https://github.com/gofiber/utils/commit/6c6cf047032b9c8dff43d29f990b4b10e9b02d47"],"sourceUrl":"https://osv.dev/vulnerability/GO-2025-4208","license":"OSV · upstream source license applies","key":"osv:GO-2025-4208","identifiers":["GO-2025-4208","CVE-2025-66565","GHSA-m98w-cqp3-qcqr"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-11T10:57:37.6316309+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-11T10:57:37.6316309+00:00","lastSuccessAt":"2026-11-11T10:57:37.7940559+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:37.7940585+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-de3b77103708811b6494d2ff7c979037d73ae579742cd1649a5c765137ae5083-b61703aa7a8a8776341875d56ae04881d75cb51c03ebed7341566c1aac4b78f3","complete":true,"records":424026,"lastAttemptAt":"2026-11-11T10:57:30.8429465+00:00","lastSuccessAt":"2026-11-11T10:57:30.772003+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:30.8429465+00:00","snapshotPublishedAt":"2026-11-11T10:28:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0e716d2e696641ec92828244b1b64678","complete":false,"records":13758,"lastAttemptAt":"2026-11-11T11:02:04.0645991+00:00","lastSuccessAt":"2026-11-11T11:02:04.1301949+00:00","error":null,"lastVerifiedAt":"2026-11-11T11:02:04.1301949+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-11T10:57:37.6316309+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-11T10:57:37.6316309+00:00","lastSuccessAt":"2026-11-11T10:57:37.7955954+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:37.7955973+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-622dd4c770014d0cabbdd0941fabd46f","complete":true,"records":13752,"lastAttemptAt":"2026-11-11T10:57:38.8624284+00:00","lastSuccessAt":"2026-11-11T10:57:38.856+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:38.856+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13812,"expectedIdentifiers":13812,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-11T10:57:31.188043+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:31.188043+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-11T10:57:30.9764176+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:30.9764176+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-b178858a6ba5f2e20262964fa29d9573839d1b8b735abe524cc7d061ebde5c37","complete":true,"records":3088,"lastAttemptAt":"2026-11-11T10:57:37.5961627+00:00","lastSuccessAt":"2026-11-11T10:57:37.4490966+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:37.5961627+00:00","snapshotPublishedAt":"2026-11-11T10:48:28+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-085e065fc9050ae18408f7e722c39653aeb186872334d7b3ec1fcafb7ed43d25","complete":true,"records":231665,"lastAttemptAt":"2026-11-11T10:57:31.0815536+00:00","lastSuccessAt":"2026-11-11T08:27:45.2700102+00:00","error":null,"lastVerifiedAt":"2026-11-11T10:57:31.0815536+00:00","snapshotPublishedAt":"2026-11-11T07:32:59+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}