{"id":"EUVD-2026-60461","revision":null,"records":[{"revision":"bc2215003d5b4f05bf808458c5238902","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-47683","aliases":[],"title":"vm2: bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.","state":0,"publishedAt":"2026-08-17T20:55:32.019+00:00","modifiedAt":"2026-08-18T15:38:37.608+00:00","affected":[{"ecosystem":"Vendor product","name":"vm2","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"patriksimek\",\n                    \"product\": \"vm2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 3.11.6\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9","https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd","https://github.com/patriksimek/vm2/releases/tag/3.11.6"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-47683","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-47683","identifiers":["CVE-2026-47683"]},"retained":false,"historicalAffected":[]},{"revision":"1735c04157d844cbb464a4d3d28d9ecc","observedAt":"2026-11-07T11:27:49.257+00:00","statement":{"source":"euvd","id":"EUVD-2026-60461","aliases":["CVE-2026-47683","GHSA-gmc2-2x9w-cgh9"],"title":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing s…","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9","https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd","https://github.com/patriksimek/vm2/releases/tag/3.11.6"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-60461","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 17, 2026, 8:55:32 PM","dateUpdated":"Aug 18, 2026, 3:38:37 PM"},"relatedAdvisories":[{"id":"RHSA-2026:91651","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.10 release.","vulnerabilityIds":["CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-84445","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606","CVE-2026-111943"]},{"id":"WID-SEC-W-2026-2865","title":"vm2: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-92961"]},{"id":"RHSA-2026:72722","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-19534","CVE-2026-47683","CVE-2026-55553","CVE-2026-56859","CVE-2026-59869","CVE-2026-82417","CVE-2026-84375","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92000","CVE-2026-92942","CVE-2026-92958","CVE-2026-92959","CVE-2026-92961"]},{"id":"RHSA-2026:76788","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 Plugin Catalog GA plugins release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-77413","CVE-2026-77414","CVE-2026-77415","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:72712","title":"Red Hat Security Advisory: Ansible plug-ins for Red Hat Developer Hub Product Release Update","vulnerabilityIds":["CVE-2026-5038","CVE-2026-19534","CVE-2026-47683","CVE-2026-55553","CVE-2026-59869","CVE-2026-59879","CVE-2026-82417","CVE-2026-84375","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92000","CVE-2026-92942","CVE-2026-92958","CVE-2026-92959","CVE-2026-92961"]},{"id":"RHSA-2026:82151","title":"Red Hat Security Advisory: Ansible automation portal Red Hat Enterprise Linux Images","vulnerabilityIds":["CVE-2026-13697","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-54284","CVE-2026-55553","CVE-2026-59893","CVE-2026-71491","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84961","CVE-2026-88932","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]},{"id":"RHSA-2026:79088","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.10.5 release.","vulnerabilityIds":["CVE-2026-13697","CVE-2026-14456","CVE-2026-18798","CVE-2026-19534","CVE-2026-47683","CVE-2026-47686","CVE-2026-47698","CVE-2026-55553","CVE-2026-63072","CVE-2026-63076","CVE-2026-67213","CVE-2026-67214","CVE-2026-67422","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77037","CVE-2026-77078","CVE-2026-82333","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84445","CVE-2026-84961","CVE-2026-87776","CVE-2026-88932","CVE-2026-89011","CVE-2026-92934","CVE-2026-92935","CVE-2026-92937","CVE-2026-92938","CVE-2026-92939","CVE-2026-92940","CVE-2026-92941","CVE-2026-92942","CVE-2026-92944","CVE-2026-92946","CVE-2026-92947","CVE-2026-92948","CVE-2026-92950","CVE-2026-92951","CVE-2026-92953","CVE-2026-92954","CVE-2026-92955","CVE-2026-92956","CVE-2026-92957","CVE-2026-92958","CVE-2026-92959","CVE-2026-92960","CVE-2026-92961","CVE-2026-93603","CVE-2026-93604","CVE-2026-93605","CVE-2026-93606"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-60461","identifiers":["EUVD-2026-60461","CVE-2026-47683","GHSA-gmc2-2x9w-cgh9"]},"retained":false,"historicalAffected":[]},{"revision":"9b8ab45d70ae4c919bfc0262860782f5","observedAt":"2026-10-25T12:17:26.301+00:00","statement":{"source":"nvd","id":"CVE-2026-47683","aliases":[],"title":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing s…","description":"vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.6, the bufferAllocLimit enforcement in lib/setup-sandbox.js does not cover Buffer.concat(list, totalLength) or Buffer.from(arrayLike) with an attacker-controlled length, allowing sandbox code to perform large synchronous host external-memory allocations that bypass the configured cap and can exhaust the host process. This issue is fixed in version 3.11.6.","state":0,"publishedAt":"2026-08-17T21:16:45.363+00:00","modifiedAt":"2026-10-23T16:10:00.313+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"}],"references":["https://github.com/patriksimek/vm2/commit/3ffb315512e634cf85c447375e85d6c83d00a4bd","https://github.com/patriksimek/vm2/releases/tag/3.11.6","https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-47683","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-770"],"productCriteria":[],"sourceDates":{"published":"2026-08-17T21:16:45.363","lastModified":"2026-10-23T16:10:00.313"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-47683","identifiers":["CVE-2026-47683"]},"retained":false,"historicalAffected":[]},{"revision":"353bf969347c4244896926bb36f0c546","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-gmc2-2x9w-cgh9","aliases":["CVE-2026-47683"],"title":"vm2's bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike","description":"## Summary\n\nvm2 bufferAllocLimit cap bypassed by Buffer.concat and Buffer.from arrayLike\n\nThe `bufferAllocLimit` option introduced in 3.11.0 (GHSA-6785-pvv7-mvg7) caps host-side Buffer allocations driven by sandbox code, the way embedders opt into `timeout`. The cap wraps `Buffer.alloc`, `Buffer.allocUnsafe`, `Buffer.allocUnsafeSlow`, and the deprecated `Buffer(N)` / `new Buffer(N)` forms. Two other API paths reach the same host C++ allocator with an attacker-controlled size and are not capped: `Buffer.concat(list, totalLength)` and `Buffer.from(arrayLike)` with a fake `length`. Sandbox code can use either to allocate an arbitrary number of host external bytes in a single call, defeating the explicit DoS mitigation the embedder configured.\n\n## Details\n\n`lib/setup-sandbox.js` installs `checkBufferAllocLimit` at every wrapped entry to host Buffer allocation:\n\n- `alloc()` at `lib/setup-sandbox.js:474` and the `connect(alloc, host.Buffer.alloc)` at line 480.\n- `allocUnsafe()` at line 488 and `connect(allocUnsafe, host.Buffer.allocUnsafe)` at line 496.\n- `allocUnsafeSlow()` at line 504 and `connect(allocUnsafeSlow, host.Buffer.allocUnsafeSlow)` at line 510.\n- `BufferHandler.apply` at line 424 and `BufferHandler.construct` at line 433 for the deprecated `Buffer(N)` / `new Buffer(N)` numeric-first-arg paths.\n\n`Buffer.concat` is not wrapped. The sandbox-visible `Buffer.concat` is therefore the bridge proxy of the host `Buffer.concat`, which calls into Node's `Buffer.allocUnsafe(totalLength)` internally without going through the sandbox-side `allocUnsafe` wrapper. Same for `Buffer.from` when the argument is array-like (`{length: N}`): Node's `fromArrayLike` allocates a buffer of size `N` before the iteration that fills it. Neither of those allocator paths consult `localBufferAllocLimit`.\n\nThe mitigation rationale documented in `docs/ATTACKS.md` Category 23 explicitly enumerates the surfaces that were considered and either capped (Buffer.alloc family) or punted to follow-up (`new Uint8Array(N)`, `new ArrayBuffer(N)`, `String.prototype.repeat`). `Buffer.concat(list, totalLength)` is not listed in either group, and `Buffer.from(arrayLike)` is mentioned only as \"bounded by source array size which had to be allocated through some other path first\" -- which is not true for the `{length: N}` form, because no array of length `N` actually exists.\n\nA single call from sandbox to `Buffer.concat([Buffer.from('a')], 50 * 1024 * 1024)` allocates 50 MiB of host external memory. The allocation itself is a single synchronous host C++ call that `timeout` cannot interrupt, exactly like the original advisory. The zero-fill that follows is interruptible, but the memory is already committed by the time the interrupt could fire, so the embedder's container memory budget is the only ceiling. The same pattern in a loop, or with a larger `totalLength`, drives RSS up by hundreds of megabytes per call.\n\nThe fix uses the existing `checkBufferAllocLimit(size)` helper and a sandbox-side wrapper installed via `connect(...)` -- one for `Buffer.concat` that sums the `totalLength` (or falls back to summing list lengths) and one for `Buffer.from` that recognises the array-like-with-numeric-`length` branch.\n\n## PoC\n\n```javascript\n'use strict';\nconst { VM, NodeVM } = require('vm2');\n\nfunction ext() { return Math.round(process.memoryUsage().external / 1024 / 1024); }\nfunction tryBypass(label, code) {\n    const ext0 = ext();\n    let buf;\n    try { buf = code(); }\n    catch (e) {\n        console.log(`[${label}] CAPPED -- ${String(e).split('\\n')[0]}`);\n        return;\n    }\n    console.log(`[${label}] BYPASSED -- got ${buf && buf.length} bytes (external +${ext() - ext0} MB)`);\n}\n\nconsole.log('Cap is configured at 1024 bytes.\\n');\n\nconst vm1 = new VM({ bufferAllocLimit: 1024 });\ntryBypass('VM Buffer.alloc(50MB)        ',\n    () => vm1.run('Buffer.alloc(50 * 1024 * 1024)'));\n\nconst vm2 = new VM({ bufferAllocLimit: 1024 });\ntryBypass('VM Buffer.concat 50MB        ',\n    () => vm2.run('Buffer.concat([Buffer.from(\"a\")], 50 * 1024 * 1024)'));\n\nconst vm3 = new NodeVM({ bufferAllocLimit: 1024 });\ntryBypass('NodeVM Buffer.concat 50MB    ',\n    () => vm3.run('module.exports = Buffer.concat([Buffer.from(\"a\")], 50 * 1024 * 1024);'));\n\nconst vm4 = new VM({ bufferAllocLimit: 1024 });\ntryBypass('VM Buffer.from({length: 8MB})',\n    () => vm4.run('Buffer.from({length: 8 * 1024 * 1024})'));\n```\n\nRun with `node poc.js` against `vm2@3.11.3`:\n\n```\nCap is configured at 1024 bytes.\n\n[VM Buffer.alloc(50MB)        ] CAPPED -- RangeError: Buffer allocation size 52428800 exceeds bufferAllocLimit 1024\n[VM Buffer.concat 50MB        ] BYPASSED -- got 52428800 bytes (external +50 MB)\n[NodeVM Buffer.concat 50MB    ] BYPASSED -- got 52428800 bytes (external +50 MB)\n[VM Buffer.from({length: 8MB})] BYPASSED -- got 8388608 bytes (external +8 MB)\n```\n\nProcess RSS climbs by the same amount each call, confirming a real host C++ allocation rather than a sandbox-realm-only effect.\n\n## Impact\n\nThis is the same DoS class GHSA-6785-pvv7-mvg7 was filed for: untrusted sandbox code amplifying a small payload into a large synchronous host external-memory allocation that V8's `timeout` cannot preempt. In the environments the advisory cites -- Docker memory limits, Kubernetes pods, AWS Lambda -- a single 200-byte sandbox payload can drive a multi-hundred-megabyte RSS jump and OOM the host process.\n\nThe Category 23 fix was specifically scoped to \"cap host Buffer external allocation\" and embedders are documented to opt into `bufferAllocLimit` as their layered defense against this class. The two paths above are uncapped, so an embedder that has configured `bufferAllocLimit: 32 * 1024 * 1024` (the value recommended in the README's Hardening recommendations) is still vulnerable to the exact attack the option was designed to prevent. The mitigation invariant -- \"every Buffer external allocation driven by sandbox code is capped by `bufferAllocLimit`\" -- does not hold.\n\nNo sandbox escape; pure DoS.","state":0,"publishedAt":"2026-08-17T17:32:10+00:00","modifiedAt":"2026-08-17T17:56:03.620615+00:00","affected":[{"ecosystem":"npm","name":"vm2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.11.6"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/patriksimek/vm2/security/advisories/GHSA-gmc2-2x9w-cgh9","https://github.com/patriksimek/vm2","https://github.com/patriksimek/vm2/releases/tag/3.11.6"],"sourceUrl":"https://github.com/advisories/GHSA-gmc2-2x9w-cgh9","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gmc2-2x9w-cgh9","identifiers":["GHSA-gmc2-2x9w-cgh9","CVE-2026-47683"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8753142+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.875316+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-5f996ab4d545d4c69ea2b6ee3009c8c4105f63df9cfbbf4c578c7470282be4b4","complete":true,"records":421074,"lastAttemptAt":"2026-11-08T05:06:53.5215713+00:00","lastSuccessAt":"2026-11-08T05:06:53.4988286+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.5215713+00:00","snapshotPublishedAt":"2026-11-08T04:25:52+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-ce0df89a405747cda5b7c61ae0b48fb2","complete":true,"records":13633,"lastAttemptAt":"2026-11-08T05:08:40.2673541+00:00","lastSuccessAt":"2026-11-08T05:08:40.263+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:40.263+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T05:06:54.7224170+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T05:06:54.722417+00:00","lastSuccessAt":"2026-11-08T05:06:54.8762568+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.8762573+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-449054d6321e4ff8818c6b898fdac406","complete":true,"records":13645,"lastAttemptAt":"2026-11-08T05:08:11.1749792+00:00","lastSuccessAt":"2026-11-08T05:08:11.17+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:08:11.17+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13685,"expectedIdentifiers":13685,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-0eb4d6dde62dffacd040ad992d4fd5a65cd7d0dc5f5f4cfa8b41967fc6f9ca5f","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T05:06:54.1714031+00:00","lastSuccessAt":"2026-11-06T20:10:36.6450506+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.1714031+00:00","snapshotPublishedAt":"2026-11-06T20:02:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T05:06:53.6785795+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:53.6785795+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-335633e78a15c9cde10a6025895b5617717087fb945489ae7e15d377bacf34a9","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T05:06:54.5508124+00:00","lastSuccessAt":"2026-11-06T16:03:00.7615789+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.5508124+00:00","snapshotPublishedAt":"2026-11-06T16:02:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-40ad6183a951565ace1520a9b4d631e1d0bfb1d4bf7c5574c375032559f3ff53","complete":true,"records":231292,"lastAttemptAt":"2026-11-08T05:06:54.0611713+00:00","lastSuccessAt":"2026-11-07T10:29:00.4821259+00:00","error":null,"lastVerifiedAt":"2026-11-08T05:06:54.0611713+00:00","snapshotPublishedAt":"2026-11-07T09:32:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}