{"id":"EUVD-2026-116374","revision":null,"records":[{"revision":"25df5dbc83be4e448f099a5d515c3faf","observedAt":"2026-11-03T22:57:17.07+00:00","statement":{"source":"cve-program","id":"CVE-2026-111752","aliases":[],"title":"Angular: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","state":0,"publishedAt":"2026-11-03T20:52:16.675+00:00","modifiedAt":"2026-11-03T20:52:16.675+00:00","affected":[{"ecosystem":"Vendor product","name":"angular","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"angular\",\n                    \"product\": \"angular\",\n                    \"versions\": [\n                        {\n                            \"version\": \"<= 19.2.25\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 20.0.0, < 20.3.33\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 21.0.0, < 21.2.25\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 22.0.0, < 22.2.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.2,"severity":"HIGH"}],"references":["https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7","https://github.com/angular/angular/issues/70932","https://github.com/angular/angular/issues/70997","https://github.com/angular/angular/pull/71055","https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-111752","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-111752","identifiers":["CVE-2026-111752"]},"retained":false,"historicalAffected":[]},{"revision":"601de49356ff4152927e55add66c830a","observedAt":"2026-11-07T04:32:42.95+00:00","statement":{"source":"euvd","id":"EUVD-2026-116374","aliases":["CVE-2026-111752","GHSA-62vg-58rm-qff7"],"title":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require aux…","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.2,"severity":null}],"references":["https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7","https://github.com/angular/angular/issues/70932","https://github.com/angular/angular/issues/70997","https://github.com/angular/angular/pull/71055","https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-116374","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 3, 2026, 8:52:16 PM","dateUpdated":"Nov 3, 2026, 8:52:16 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-116374","identifiers":["EUVD-2026-116374","CVE-2026-111752","GHSA-62vg-58rm-qff7"]},"retained":false,"historicalAffected":[]},{"revision":"2dd3abe1abb34bc1a58a87d29c6aed16","observedAt":"2026-11-04T08:57:34.019+00:00","statement":{"source":"nvd","id":"CVE-2026-111752","aliases":[],"title":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require aux…","description":"Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.33, 21.2.25, and 22.2.1, @angular/router in Node.js server-side rendering fails to require auxiliary outlet URL segments to match routes configured for their outlet names. Crafted requests containing multiple unconfigured empty-path outlet groups can repeatedly evaluate the route configuration, construct duplicate ActivatedRouteSnapshot trees, execute canMatch guards and resolvers, and copy route parameters and queryParams for each outlet. An unauthenticated remote attacker can exhaust the Node.js heap or CPU and terminate an SSR worker when SSR is enabled, a route level contains an empty-path route or named outlet, upstream infrastructure forwards the request target, and the worker has a constrained heap. The allocation is transient rather than a persistent leak, and client-side SPAs and build-time prerendering are not affected. This issue is fixed in versions 20.3.33, 21.2.25, and 22.2.1.","state":0,"publishedAt":"2026-11-03T21:16:57.993+00:00","modifiedAt":"2026-11-03T21:16:57.993+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.2,"severity":"HIGH"}],"references":["https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","https://github.com/angular/angular/issues/70932","https://github.com/angular/angular/issues/70997","https://github.com/angular/angular/pull/71055","https://github.com/angular/angular/releases/tag/v20.3.33","https://github.com/angular/angular/releases/tag/v21.2.25","https://github.com/angular/angular/releases/tag/v22.2.1","https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-111752","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Received","weaknesses":["CWE-400","CWE-405"],"productCriteria":[],"sourceDates":{"published":"2026-11-03T21:16:57.993","lastModified":"2026-11-03T21:16:57.993"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-111752","identifiers":["CVE-2026-111752"]},"retained":false,"historicalAffected":[]},{"revision":"cb72054923ae4b95bfaef26c9356442c","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-62vg-58rm-qff7","aliases":["CVE-2026-111752"],"title":"@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)","description":"A denial of service (DoS) vulnerability was identified in `@angular/router` when Server-Side Rendering (SSR) is enabled on Node.js (V8).\n\nDuring route recognition, `@angular/router` fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name. Because unconfigured empty-path outlet groups (such as `a:/()`, `x:/(...)`, or `///(...)`) are not rejected during matching, the router repeatedly re-evaluates the route configuration against each arbitrary outlet segment provided in the URL.\n\nWhen a request URL contains multiple arbitrary empty-path outlet segments, this improper matching forces the router to instantiate duplicate `ActivatedRouteSnapshot` trees, repeatedly execute `canMatch` guards and route resolvers, and allocate separate copies of route parameters and `queryParams` for each unconfigured outlet.\n\nAn unauthenticated remote attacker can exploit this behavior by sending requests with crafted outlet segments to exhaust the Node.js memory heap or overwhelm CPU resources, leading to SSR worker termination and service disruption.\n\n### Impact\n\nSuccessful exploitation allows an unauthenticated remote attacker to exhaust the Node.js heap with a single crafted request or a small number of concurrent requests, terminating the SSR worker process with a fatal JavaScript heap out-of-memory crash. When the matched routes declare `canMatch` guards or resolvers, a single short request can also trigger repeated guard or resolver executions, increasing load on backend services and holding worker connections open.\n\n* **Transient Allocation:** Memory is released once route recognition completes; there is no persistent memory leak. The primary impact is process termination.\n* **Client-side SPAs Unaffected:** Client-side Angular applications running in the browser are not vulnerable, as browser memory consumption does not cross a security boundary.\n* **Prerendering (SSG) Unaffected:** Build-time prerendering does not process attacker-supplied request URLs.\n\n### Attack Preconditions & Vulnerable Configurations\n\nAn application is affected only if all of the following conditions are met:\n\n1. **SSR Enabled:** The application renders on demand on a Node.js / V8 server.\n2. **Susceptible Route Configuration:** At least one level of the route configuration contains either:\n   * an empty-path (`path: \"\"`) route (e.g., `{path: \"\", component: ShopPage}`), or\n   * a route assigned to a named outlet (e.g., `{path: \"dashboard\", children: [{path: \":id\", outlet: \"detail\", component: DetailPanel}]}`).\n3. **Upstream Request Line Forwarding:** Request lines reach the Node.js process without being rejected upstream by edge proxies. Node.js accepts request headers up to 16 KiB by default. Guard/resolver amplification requires only a short URL.\n4. **Constrained Heap Size:** Worker heaps are sized small enough relative to the request payload and concurrency (e.g., containers or serverless instances configured with 128 MiB–1 GiB).\n\n### Exploit Payload Examples\n\nAgainst a configuration with empty-path (`path: \"\"`) routes and query parameters:\n\n```http\nGET /shop/(a:/()//b:/()//c:/()//...)?param1=value&param2=value... HTTP/1.1\nHost: example.com\n```\n\nAgainst a configuration with named-outlet or sibling routes:\n\n```http\nGET /dashboard/(detail:1//x:/(detail:1//x:/(...)//y:/(...))//y:/(...)) HTTP/1.1\nHost: example.com\n```\n\n### Patches\n\nThe issue is resolved in [angular/angular#71055](https://github.com/angular/angular/pull/71055). The router now requires every child outlet segment group to match a route configured for its target outlet before unwrapping child segments or completing a match, and prevents unconfigured empty-path outlet groups from matching routes declared for other outlets.\n\nPatched versions:\n* `22.2.1`\n* `21.2.25`\n* `20.3.33`\n\nVersions prior to v20 are also affected but are no longer supported and will not receive a patch.\n\n### Workarounds & Mitigations\n\nIf you cannot immediately upgrade to a patched version, apply one or more of the following mitigations:\n\n1. **Reject Parenthesized or Empty-Path Outlet URLs in Middleware or WAF (Recommended):**\n   In `@angular/router`, auxiliary outlet groups in a URL always use parentheses `(...)`, and empty-path outlet groups in a URL always take the form `:/( `, `(/ `, or `///( `.\n\n   * If your application does **not** use named (auxiliary) outlets in URLs, reject requests whose path contains `(` or `)` before Angular SSR handles the request.\n   * If your application does use named outlets, reject requests whose path contains empty-path outlet sequences (`:/( `, `(/ `, or `///( `).\n\n   Unlike URL length limits, this completely blocks both heap exhaustion and short-URL guard/resolver amplification:\n\n   ```typescript\n   // server.ts (placed before Angular SSR handler)\n   app.use((req, res, next) => {\n     let pathname: string;\n     try {\n       pathname = decodeURI(req.url.split(/[?#]/, 1)[0]);\n     } catch {\n       res.status(400).send(\"Bad Request\");\n       return;\n     }\n\n     // Option A: If the app does not use named outlets in URLs, block all parenthesized groups:\n     if (/[()]/.test(pathname)) {\n       res.status(400).send(\"Bad Request\");\n       return;\n     }\n\n     // Option B: If the app uses named outlets, block only empty-path outlet groups:\n     if (/:\\/\\(|\\(\\//\\(|\\/\\/\\/\\(/.test(pathname)) {\n       res.status(400).send(\"Bad Request\");\n       return;\n     }\n\n     next();\n   });\n   ```\n\n2. **Limit URL Length at Reverse Proxy or Middleware:**\n   Configure your edge proxy, web application firewall (WAF), or reverse proxy to reject requests with excessively long URLs (e.g., exceeding 2,048 bytes). The outlet portion of the payload is in the path, so limit the full request target, not only the query string. This reduces, but does not eliminate, guard/resolver amplification, which requires only a short URL.\n\n3. **Increase Node.js Old Space:**\n   Increasing `--max-old-space-size` raises the request size and concurrency required to exhaust memory, though it does not eliminate the issue.","state":0,"publishedAt":"2026-10-20T14:36:39+00:00","modifiedAt":"2026-10-20T14:45:03.7827257+00:00","affected":[{"ecosystem":"npm","name":"@angular/router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"22.0.0"},{"kind":"fixed","version":"22.2.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@angular/router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"21.0.0"},{"kind":"fixed","version":"21.2.25"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@angular/router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"20.0.0"},{"kind":"fixed","version":"20.3.33"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@angular/router","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"19.2.25"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/angular/angular/security/advisories/GHSA-62vg-58rm-qff7","https://github.com/angular/angular/issues/70997","https://github.com/angular/angular/pull/71055","https://github.com/angular/angular/commit/a83f8119acd466b524ae0113096ed188358d6d6c","https://github.com/angular/angular/commit/b0d2ba0f54e21cb57ea5a0ca0d8e6065f28e23a0","https://github.com/angular/angular/commit/b6bf6504adab1a78cc62ad8402f6bed229e620bd","https://github.com/angular/angular/commit/e9bf52aa03a3b9b302c33ffbc967ef0e1de5fb79","https://github.com/angular/angular"],"sourceUrl":"https://github.com/advisories/GHSA-62vg-58rm-qff7","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-62vg-58rm-qff7","identifiers":["GHSA-62vg-58rm-qff7","CVE-2026-111752"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8442875+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8442884+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-4b0775bb0fc73c3ceeed66f8f17640894d61d654f97ee9386046b283ad9f9876","complete":true,"records":421100,"lastAttemptAt":"2026-11-08T14:04:21.1432513+00:00","lastSuccessAt":"2026-11-08T14:04:21.1228768+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.1432513+00:00","snapshotPublishedAt":"2026-11-08T13:27:32+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-383c643166b94ac4b6a615647191978e","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T14:04:47.6384375+00:00","lastSuccessAt":"2026-11-08T13:04:50.073+00:00","error":null,"lastVerifiedAt":"2026-11-08T13:04:50.073+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T14:04:21.6524616+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T14:04:21.6524616+00:00","lastSuccessAt":"2026-11-08T14:04:21.8452187+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.8452194+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ceefbd28b79c4b75ac56c9c678246411","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T14:04:46.9956646+00:00","lastSuccessAt":"2026-11-08T14:04:46.992+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:46.992+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13185,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T14:04:21.5047325+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.5047325+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T14:04:21.2941446+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.2941446+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T14:04:21.6167179+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.6167179+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T14:04:21.3943214+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T14:04:21.3943214+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}