{"id":"EUVD-2026-4773","revision":null,"records":[{"revision":"36eb53792fb2472f9e05cb9eb81ceaff","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-24116","aliases":[],"title":"Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64","description":"Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests. Wasmtime 36.0.5, 40.0.3, and 41.0.1 have been released to fix this issue. Users are recommended to upgrade to the patched versions of Wasmtime. Other affected versions are not patched and users should updated to supported major version instead. This bug can be worked around by enabling signals-based-traps. While disabling guard pages can be a quick fix in some situations, it's not recommended to disabled guard pages as it is a key defense-in-depth measure of Wasmtime.","state":0,"publishedAt":"2026-01-27T18:58:52.349+00:00","modifiedAt":"2026-01-27T19:23:09.391+00:00","affected":[{"ecosystem":"Vendor product","name":"wasmtime","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"bytecodealliance\",\n                    \"product\": \"wasmtime\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 29.0.0, < 36.0.5\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 37.0.0, < 40.0.3\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"= 41.0.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":4.1,"severity":"MEDIUM"}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73","https://github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6","https://github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440","https://github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.memory_guard_size","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.signals_based_traps","https://docs.wasmtime.dev/stability-release.html","https://rustsec.org/advisories/RUSTSEC-2026-0006.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-24116","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-24116","identifiers":["CVE-2026-24116"]},"retained":false,"historicalAffected":[]},{"revision":"680d7f9e833d4784bfe7f3a26063cf83","observedAt":"2026-11-09T06:07:43.132+00:00","statement":{"source":"euvd","id":"EUVD-2026-4773","aliases":["CVE-2026-24116","GHSA-vc8c-j3xm-xj73"],"title":"Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 …","description":"Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests. Wasmtime 36.0.5, 40.0.3, and 41.0.1 have been released to fix this issue. Users are recommended to upgrade to the patched versions of Wasmtime. Other affected versions are not patched and users should updated to supported major version instead. This bug can be worked around by enabling signals-based-traps. While disabling guard pages can be a quick fix in some situations, it's not recommended to disabled guard pages as it is a key defense-in-depth measure of Wasmtime.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":4.1,"severity":null}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73","https://github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6","https://github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440","https://github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.memory_guard_size","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.signals_based_traps","https://docs.wasmtime.dev/stability-release.html","https://rustsec.org/advisories/RUSTSEC-2026-0006.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-4773","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jan 27, 2026, 6:58:52 PM","dateUpdated":"Jan 27, 2026, 7:23:09 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-4773","identifiers":["EUVD-2026-4773","CVE-2026-24116","GHSA-vc8c-j3xm-xj73"]},"retained":false,"historicalAffected":[]},{"revision":"3b7a033a84414bc588f554fbd304185f","observedAt":"2026-10-25T05:17:36.726+00:00","statement":{"source":"nvd","id":"CVE-2026-24116","aliases":[],"title":"Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 …","description":"Wasmtime is a runtime for WebAssembly. Starting in version 29.0.0 and prior to version 36.0.5, 40.0.3, and 41.0.1, on x86-64 platforms with AVX, Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When signals-based-traps are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests. Wasmtime 36.0.5, 40.0.3, and 41.0.1 have been released to fix this issue. Users are recommended to upgrade to the patched versions of Wasmtime. Other affected versions are not patched and users should updated to supported major version instead. This bug can be worked around by enabling signals-based-traps. While disabling guard pages can be a quick fix in some situations, it's not recommended to disabled guard pages as it is a key defense-in-depth measure of Wasmtime.","state":0,"publishedAt":"2026-01-27T19:16:16.18+00:00","modifiedAt":"2026-06-17T10:22:39.38+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":4.1,"severity":"MEDIUM"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","score":5.5,"severity":"MEDIUM"}],"references":["https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.memory_guard_size","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.signals_based_traps","https://docs.wasmtime.dev/stability-release.html","https://github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6","https://github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440","https://github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227","https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73","https://rustsec.org/advisories/RUSTSEC-2026-0006.html"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-24116","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-125"],"productCriteria":["cpe:2.3:a:bytecodealliance:wasmtime:*:*:*:*:*:rust:*:*"],"sourceDates":{"published":"2026-01-27T19:16:16.180","lastModified":"2026-06-17T10:22:39.380"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-24116","identifiers":["CVE-2026-24116"]},"retained":false,"historicalAffected":[]},{"revision":"75e9d8e9682f438ebe7311212f3c08bb","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"GHSA-vc8c-j3xm-xj73","aliases":["CVE-2026-24116","RUSTSEC-2026-0006"],"title":"Wasmtime segfault or unused out-of-sandbox load with f64.copysign operator on x86-64","description":"On x86-64 platforms with AVX Wasmtime's compilation of the `f64.copysign` WebAssembly instruction with Cranelift may load 8 more bytes than is necessary. When [signals-based-traps] are disabled this can result in a uncaught segfault due to loading from unmapped guard pages. With guard pages disabled it's possible for out-of-sandbox data to be loaded, but unless there is another bug in Cranelift this data is not visible to WebAssembly guests.\n\n### Details\n\nThe `f64.copysign` operator, when operating on a value loaded from a memory (for example with `f64.load`), compiles with Cranelift to code on x86-64 with AVX that loads 128 bits (16 bytes) rather than the expected 64 bits (8 bytes) from memory. When the address is in-bounds for a (correct) 8-byte load but not an (incorrect) 16-byte load, this can load beyond memory by up to 8 bytes. This can result in three different behaviors depending on Wasmtime's configuration:\n\n1. If guard pages are disabled then this extra data will be loaded. The extra data is present in the upper bits of a register, but the upper bits are not visible to WebAssembly guests. Actually witnessing this data would require a different bug in Cranelift, of which none are known. Thus in this situation while it's something we're patching in Cranelift it's not a security issue.\n2. If guard pages are enabled, and [signals-based-traps] are enabled, then this operation will result in a safe WebAssembly trap. The trap is incorrect because the load is not out-of-bounds as defined by WebAssembly, but this mistakenly widened load will load bytes from an unmapped guard page, causing a segfault which is caught and handled as a Wasm trap. In this situation this is not a security issue, but we're patching Cranelift to fix the WebAssembly behavior.\n3. If guard pages are enabled, and [signals-based-traps] are disabled, then this operation results in an uncaught segfault. Like the previous case with guard pages enabled this will load from an unmapped guard page. Unlike before, however, signals-based-traps are disabled meaning that signal handlers aren't configured. The resulting segfault will, by default, terminate the process. This is a security issue from a DoS perspective, but does not represent an arbitrary read or write from WebAssembly, for example.\n\nWasmtime's default configuration is case (2) in this case. That means that Wasmtime, by default, incorrectly executes this WebAssembly instruction but does not have insecure behavior.\n\n### Impact\n\nIf [signals-based-traps] are disabled and guard pages are enabled then guests can trigger an uncaught segfault in the host, likely aborting the host process. This represents, for example, a DoS vector for WebAssembly guests.\n\nThis bug does not affect Wasmtime's default configuration and requires [signals-based-traps] to be disabled. This bug only affects the x86-64 target with the AVX feature enabled and the Cranelift backend (Wasmtime's default backend).\n\n### Patches\n\nWasmtime 36.0.5, 40.0.3, and 41.0.1 have been released to fix this issue. Users are recommended to upgrade to the patched versions of Wasmtime. Other affected versions [are not patched](https://docs.wasmtime.dev/stability-release.html) and users should updated to supported major version instead.\n\n### Workarounds\n\nThis bug can be worked around by enabling [signals-based-traps]. While disabling guard pages can be a quick fix in some situations, it's not recommended to disabled guard pages as it is a key defense-in-depth measure of Wasmtime.\n\n### Resources\n\n* [signals-based-traps configuration][signals-based-traps]\n* [guard pages configuration](https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.memory_guard_size)\n\n[signals-based-traps]: https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.signals_based_traps","state":0,"publishedAt":"2026-01-27T00:48:20+00:00","modifiedAt":"2026-09-10T03:50:59.2668082+00:00","affected":[{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"29.0.0"},{"kind":"fixed","version":"36.0.5"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"37.0.0"},{"kind":"fixed","version":"40.0.3"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"41.0.0"},{"kind":"fixed","version":"41.0.1"}]}],"versions":["41.0.0"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73","https://nvd.nist.gov/vuln/detail/CVE-2026-24116","https://github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6","https://github.com/bytecodealliance/wasmtime/commit/799585fc362fcb991de147dd1a9f2ba0861ed440","https://github.com/bytecodealliance/wasmtime/commit/ac92d9bb729ad3a6d93f0724c4c33a0c4a9c0227","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.memory_guard_size","https://docs.rs/wasmtime/latest/wasmtime/struct.Config.html#method.signals_based_traps","https://docs.wasmtime.dev/stability-release.html","https://github.com/bytecodealliance/wasmtime","https://rustsec.org/advisories/RUSTSEC-2026-0006.html"],"sourceUrl":"https://github.com/advisories/GHSA-vc8c-j3xm-xj73","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vc8c-j3xm-xj73","identifiers":["GHSA-vc8c-j3xm-xj73","CVE-2026-24116","RUSTSEC-2026-0006"]},"retained":false,"historicalAffected":[]},{"revision":"c3e5a52af4694616a6f87eeec53c8fed","observedAt":"2026-10-24T13:19:54.901+00:00","statement":{"source":"osv","id":"RUSTSEC-2026-0006","aliases":["CVE-2026-24116","GHSA-vc8c-j3xm-xj73"],"title":"Wasmtime segfault or unused out-of-sandbox load with `f64.copysign` operator on x86-64","description":"This is an entry in the RustSec database for the Wasmtime security advisory\nlocated at\nhttps://github.com/bytecodealliance/wasmtime/security/advisories/GHSA-vc8c-j3xm-xj73\nFor more information see the GitHub-hosted security advisory.","state":0,"publishedAt":"2026-01-26T12:00:00+00:00","modifiedAt":"2026-10-12T18:00:13.5598802+00:00","affected":[{"ecosystem":"crates.io","name":"wasmtime","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"29.0.0"},{"kind":"fixed","version":"36.0.5"},{"kind":"introduced","version":"37.0.0"},{"kind":"fixed","version":"40.0.3"},{"kind":"introduced","version":"41.0.0"},{"kind":"fixed","version":"41.0.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null}],"references":["https://crates.io/crates/wasmtime","https://rustsec.org/advisories/RUSTSEC-2026-0006.html","https://github.com/bytecodealliance/wasmtime/commit/728fa07184f8da2a046f48ef9b61f869dce133a6"],"sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0006","license":"OSV · upstream source license applies","key":"osv:RUSTSEC-2026-0006","identifiers":["RUSTSEC-2026-0006","CVE-2026-24116","GHSA-vc8c-j3xm-xj73"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1773,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4268898+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4268987+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-8859cf40d4337e24bd2f258cc7778fbad01bb24c79d057aaf34cf1dfc6f8917d-8bdcdeeb414e06ff50ed637d818ac25d52680d19f71fc0ebe3f4c4b3f836ed38","complete":true,"records":421927,"lastAttemptAt":"2026-11-10T10:21:22.8157744+00:00","lastSuccessAt":"2026-11-10T09:21:38.1064889+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8157744+00:00","snapshotPublishedAt":"2026-11-10T09:20:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-2e6a476534094233b48f2f0b6da5cf35","complete":true,"records":13689,"lastAttemptAt":"2026-11-10T10:21:50.2500014+00:00","lastSuccessAt":"2026-11-10T06:05:35.03+00:00","error":null,"lastVerifiedAt":"2026-11-10T06:05:35.03+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13742,"expectedIdentifiers":13742,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-10T10:21:23.1769119+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-10T10:21:23.1769119+00:00","lastSuccessAt":"2026-11-10T10:21:23.4276529+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.4276532+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b0b0499af228434598651aa5d221386e","complete":false,"records":13695,"lastAttemptAt":"2026-11-10T10:21:49.6403901+00:00","lastSuccessAt":"2026-11-10T10:21:49.637+00:00","error":"100 identifier lookups failed; latest failures include request timeout. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-10T10:21:49.637+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13642,"expectedIdentifiers":13742,"failedIdentifiers":100},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-cdffb4589856378aa42e8d1bd4a6c74e27a180d8160bf764c44715ef760f0a62","complete":true,"records":9932,"lastAttemptAt":"2026-11-10T10:21:23.1241572+00:00","lastSuccessAt":"2026-11-10T00:04:19.8260565+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1241572+00:00","snapshotPublishedAt":"2026-11-09T23:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-26503967ae4379db8f374089589d6e03fb15bd31f820c9e992aaf93840c2236c","complete":true,"records":1971,"lastAttemptAt":"2026-11-10T10:21:22.8858542+00:00","lastSuccessAt":"2026-11-09T21:02:20.472473+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:22.8858542+00:00","snapshotPublishedAt":"2026-11-09T20:18:18+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-94169eec81ea3989aa551092397ff34ae53c104b4a6ce646e1524452e4ab2a39","complete":true,"records":3065,"lastAttemptAt":"2026-11-10T10:21:23.1397622+00:00","lastSuccessAt":"2026-11-10T08:04:45.5923716+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.1397622+00:00","snapshotPublishedAt":"2026-11-10T06:48:01+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-4331051b0b2d4ccdbdca3aa196b0be3818a465064a4b18dde4cf39c2250eb490","complete":true,"records":231599,"lastAttemptAt":"2026-11-10T10:21:23.0142877+00:00","lastSuccessAt":"2026-11-10T08:04:37.1757322+00:00","error":null,"lastVerifiedAt":"2026-11-10T10:21:23.0142877+00:00","snapshotPublishedAt":"2026-11-10T07:33:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}