{"id":"EUVD-2026-16620","revision":null,"records":[{"revision":"58a18b5095fb48ac9f784083eb5097bf","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-33750","aliases":[],"title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","state":0,"publishedAt":"2026-03-27T14:04:52.297+00:00","modifiedAt":"2026-03-27T14:48:06.779+00:00","affected":[{"ecosystem":"Vendor product","name":"brace-expansion","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"juliangruber\",\n                    \"product\": \"brace-expansion\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 4.0.0, < 5.0.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 3.0.0, < 3.0.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 2.0.0, < 2.0.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"< 1.1.13\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-33750","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-33750","identifiers":["CVE-2026-33750"]},"retained":false,"historicalAffected":[]},{"revision":"5631c4da2b8e4071bf39a535d0383aed","observedAt":"2026-11-01T05:15:50.523+00:00","statement":{"source":"euvd","id":"EUVD-2026-16620","aliases":["CVE-2026-33750","GHSA-f886-m6hf-6m8v"],"title":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop…","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":null}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16620","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 27, 2026, 2:04:52 PM","dateUpdated":"Mar 27, 2026, 2:48:06 PM"},"relatedAdvisories":[{"id":"msrc_CVE-2026-33750","title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","vulnerabilityIds":["CVE-2026-33750"]},{"id":"WID-SEC-W-2026-3046","title":"IBM Concert: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-19921","CVE-2021-23337","CVE-2024-3651","CVE-2024-39338","CVE-2024-45590","CVE-2025-13465","CVE-2025-15284","CVE-2025-15599","CVE-2025-22874","CVE-2025-47273","CVE-2025-47907","CVE-2025-52881","CVE-2025-53643","CVE-2025-55184","CVE-2025-58056","CVE-2025-58188","CVE-2025-58189","CVE-2025-61723","CVE-2025-61730","CVE-2025-64649","CVE-2025-64756","CVE-2025-67221","CVE-2025-68121","CVE-2025-68146","CVE-2026-0540","CVE-2026-2327","CVE-2026-23490","CVE-2026-23897","CVE-2026-2391","CVE-2026-23949","CVE-2026-24486","CVE-2026-25528","CVE-2026-25547","CVE-2026-25639","CVE-2026-25990","CVE-2026-26007","CVE-2026-26019","CVE-2026-26996","CVE-2026-27142","CVE-2026-27212","CVE-2026-27699","CVE-2026-27903","CVE-2026-27904","CVE-2026-28684","CVE-2026-29063","CVE-2026-29181","CVE-2026-2950","CVE-2026-31808","CVE-2026-31900","CVE-2026-32274","CVE-2026-32288","CVE-2026-32597","CVE-2026-32630","CVE-2026-32887","CVE-2026-32952","CVE-2026-33186","CVE-2026-33532","CVE-2026-33750","CVE-2026-33814","CVE-2026-33816","CVE-2026-33916","CVE-2026-34043","CVE-2026-34073","CVE-2026-34077","CVE-2026-3520","CVE-2026-35469","CVE-2026-35515","CVE-2026-3627","CVE-2026-39823","CVE-2026-39825","CVE-2026-39826","CVE-2026-39892","CVE-2026-39984","CVE-2026-40175","CVE-2026-40179","CVE-2026-40181","CVE-2026-40190","CVE-2026-40347","CVE-2026-41066","CVE-2026-41182","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-41324","CVE-2026-41425","CVE-2026-41481","CVE-2026-41488","CVE-2026-41602","CVE-2026-41636","CVE-2026-42151","CVE-2026-42154","CVE-2026-42198","CVE-2026-42211","CVE-2026-42338","CVE-2026-42342","CVE-2026-42561","CVE-2026-42577","CVE-2026-43870","CVE-2026-44405","CVE-2026-44431","CVE-2026-44432","CVE-2026-44486","CVE-2026-44487","CVE-2026-44488","CVE-2026-44492","CVE-2026-44494","CVE-2026-44496","CVE-2026-44728","CVE-2026-4539","CVE-2026-45409","CVE-2026-45736","CVE-2026-46625","CVE-2026-4800","CVE-2026-4923","CVE-2026-4926","CVE-2026-7246","CVE-2026-8723"]},{"id":"RHSA-2026:56431","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.18.27 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2025-61726","CVE-2025-61729","CVE-2025-64718","CVE-2025-68470","CVE-2026-1525","CVE-2026-1526","CVE-2026-1527","CVE-2026-2229","CVE-2026-6321","CVE-2026-6322","CVE-2026-6733","CVE-2026-6734","CVE-2026-9358","CVE-2026-9679","CVE-2026-9697","CVE-2026-11525","CVE-2026-12143","CVE-2026-12151","CVE-2026-13149","CVE-2026-13676","CVE-2026-22036","CVE-2026-25645","CVE-2026-33186","CVE-2026-33349","CVE-2026-33671","CVE-2026-33672","CVE-2026-33750","CVE-2026-34043","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-40181","CVE-2026-41305","CVE-2026-41650","CVE-2026-41907","CVE-2026-42342","CVE-2026-45409","CVE-2026-45736","CVE-2026-48779","CVE-2026-48801","CVE-2026-53550","CVE-2026-59869"]},{"id":"WID-SEC-W-2026-1608","title":"Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen","vulnerabilityIds":["CVE-2019-13990","CVE-2022-1471","CVE-2022-23521","CVE-2022-41903","CVE-2023-22518","CVE-2023-22522","CVE-2023-22523","CVE-2023-22524","CVE-2023-22527","CVE-2023-24998","CVE-2023-46604","CVE-2024-45801","CVE-2025-52999","CVE-2025-67030","CVE-2026-22029","CVE-2026-22732","CVE-2026-24734","CVE-2026-24880","CVE-2026-25639","CVE-2026-26960","CVE-2026-27727","CVE-2026-27830","CVE-2026-29062","CVE-2026-29129","CVE-2026-29145","CVE-2026-29146","CVE-2026-29786","CVE-2026-31802","CVE-2026-33750","CVE-2026-34483","CVE-2026-34487","CVE-2026-39304","CVE-2026-42198","CVE-2026-5598"]},{"id":"RHSA-2026:56928","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.22.2 security, enhancement & bug fix update","vulnerabilityIds":["CVE-2026-6321","CVE-2026-6322","CVE-2026-9358","CVE-2026-33671","CVE-2026-33672","CVE-2026-33750","CVE-2026-40181","CVE-2026-41305","CVE-2026-41650","CVE-2026-41907","CVE-2026-42338","CVE-2026-44665","CVE-2026-45149","CVE-2026-45736"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-16620","identifiers":["EUVD-2026-16620","CVE-2026-33750","GHSA-f886-m6hf-6m8v"]},"retained":false,"historicalAffected":[]},{"revision":"9d6a68c94cf54a9ba05f3df1ede37d77","observedAt":"2026-10-27T09:02:55.767+00:00","statement":{"source":"nvd","id":"CVE-2026-33750","aliases":[],"title":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop…","description":"The brace-expansion library generates arbitrary strings containing a common prefix and suffix. Prior to versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13, a brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory. Versions 5.0.5, 3.0.2, 2.0.3, and 1.1.13 fix the issue. As a workaround, sanitize strings passed to `expand()` to ensure a step value of `0` is not used.","state":0,"publishedAt":"2026-03-27T15:16:57.297+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":6.5,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33750","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-400"],"productCriteria":["cpe:2.3:a:juliangruber:brace-expansion:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-03-27T15:16:57.297","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-33750","identifiers":["CVE-2026-33750"]},"retained":false,"historicalAffected":[]},{"revision":"ce7602c3bb3241b98381eee39b8018e5","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-f886-m6hf-6m8v","aliases":["CVE-2026-33750"],"title":"brace-expansion: Zero-step sequence causes process hang and memory exhaustion","description":"### Impact\n\nA brace pattern with a zero step value (e.g., `{1..2..0}`) causes the sequence generation loop to run indefinitely, making the process hang for seconds and allocate heaps of memory.\n\nThe loop in question:\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184\n\n`test()` is one of\n\nhttps://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113\n\nThe increment is computed as `Math.abs(0) = 0`, so the loop variable never advances. On a test machine, the process hangs for about 3.5 seconds and allocates roughly 1.9 GB of memory before throwing a `RangeError`. Setting max to any value has no effect because the limit is only checked at the output combination step, not during sequence generation.\n\nThis affects any application that passes untrusted strings to expand(), or by error sets a step value of `0`. That includes tools built on minimatch/glob that resolve patterns from CLI arguments or config files. The input needed is just 10 bytes.\n\n### Patches\n\n\nUpgrade to versions\n- 5.0.5+\n\nA step increment of 0 is now sanitized to 1, which matches bash behavior.\n\n### Workarounds\n\nSanitize strings passed to `expand()` to ensure a step value of `0` is not used.","state":0,"publishedAt":"2026-03-26T18:29:42+00:00","modifiedAt":"2026-09-10T03:51:00.3423568+00:00","affected":[{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"4.0.0"},{"kind":"fixed","version":"5.0.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.0.0"},{"kind":"fixed","version":"3.0.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.0.0"},{"kind":"fixed","version":"2.0.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"brace-expansion","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.1.13"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/juliangruber/brace-expansion/security/advisories/GHSA-f886-m6hf-6m8v","https://nvd.nist.gov/vuln/detail/CVE-2026-33750","https://github.com/juliangruber/brace-expansion/issues/98","https://github.com/juliangruber/brace-expansion/pull/95","https://github.com/juliangruber/brace-expansion/pull/96","https://github.com/juliangruber/brace-expansion/pull/97","https://github.com/juliangruber/brace-expansion/commit/311ac0d54994158c0a384e286a7d6cbb17ee8ed5","https://github.com/juliangruber/brace-expansion/commit/7fd684f89fdde3549563d0a6522226a9189472a2","https://github.com/juliangruber/brace-expansion/commit/b9cacd9e55e7a1fa588fe4b7bb1159d52f1d902a","https://github.com/juliangruber/brace-expansion","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L107-L113","https://github.com/juliangruber/brace-expansion/blob/daa71bcb4a30a2df9bcb7f7b8daaf2ab30e5794a/src/index.ts#L184"],"sourceUrl":"https://github.com/advisories/GHSA-f886-m6hf-6m8v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-f886-m6hf-6m8v","identifiers":["GHSA-f886-m6hf-6m8v","CVE-2026-33750"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T13:57:21.0120005+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T13:57:21.0120005+00:00","lastSuccessAt":"2026-11-01T13:57:21.1632398+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:21.1632407+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-50400654721c20d1e62d5e20161fa1011500efbfa4660bff21fbf42ab394284d","complete":true,"records":417651,"lastAttemptAt":"2026-11-01T13:57:20.4803086+00:00","lastSuccessAt":"2026-11-01T13:57:20.4526709+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.4803086+00:00","snapshotPublishedAt":"2026-11-01T13:22:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-16dea3261a6142e0a956a04888eec4c6","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T14:09:22.4460439+00:00","lastSuccessAt":"2026-11-01T14:09:22.442+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:09:22.442+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13443,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T13:57:21.0120005+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T13:57:21.0120005+00:00","lastSuccessAt":"2026-11-01T13:57:21.1641254+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:21.1641257+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-40f3d0cdd04e4088bac6e8bb2fe516b0","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T13:57:34.3841835+00:00","lastSuccessAt":"2026-11-01T13:57:34.38+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:34.38+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T13:57:20.8674133+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.8674133+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T13:57:20.6544139+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.6544139+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T13:57:20.9796516+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.9796516+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T13:57:20.7638808+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.7638808+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}