{"id":"EUVD-2026-78782","revision":null,"records":[{"revision":"54ed5917e0d347eaaba38469a183f738","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-59973","aliases":[],"title":"mcp-from-openapi: Bypass of OpenAPI external $ref SSRF fix in latest FrontMCP and mcp-from-openapi","description":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.","state":0,"publishedAt":"2026-09-15T15:13:40.053+00:00","modifiedAt":"2026-09-16T16:06:53.148+00:00","affected":[{"ecosystem":"Vendor product","name":"frontmcp","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"agentfront\",\n                    \"product\": \"frontmcp\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"mcp-from-openapi","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"agentfront\",\n                    \"product\": \"mcp-from-openapi\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 2.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"adapters","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@frontmcp\",\n                    \"product\": \"adapters\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.5.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5,"severity":"HIGH"}],"references":["https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c","https://github.com/agentfront/frontmcp/pull/496","https://github.com/agentfront/mcp-from-openapi/pull/7","https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d","https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277","https://github.com/agentfront/frontmcp/releases/tag/v1.5.0","https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59973","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-59973","identifiers":["CVE-2026-59973"]},"retained":false,"historicalAffected":[]},{"revision":"b24425d1791f4cd2b361f35f1564f5de","observedAt":"2026-11-11T15:02:26.819+00:00","statement":{"source":"euvd","id":"EUVD-2026-78782","aliases":["CVE-2026-59973","GHSA-65h7-9wrw-629c"],"title":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec(…","description":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5,"severity":null}],"references":["https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c","https://github.com/agentfront/frontmcp/pull/496","https://github.com/agentfront/mcp-from-openapi/pull/7","https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d","https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277","https://github.com/agentfront/frontmcp/releases/tag/v1.5.0","https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-78782","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 15, 2026, 3:13:40 PM","dateUpdated":"Sep 16, 2026, 4:06:53 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-78782","identifiers":["EUVD-2026-78782","CVE-2026-59973","GHSA-65h7-9wrw-629c"]},"retained":false,"historicalAffected":[]},{"revision":"cbcaa64674dc45aeb3fb4a39315ac78f","observedAt":"2026-10-25T14:19:22.811+00:00","statement":{"source":"nvd","id":"CVE-2026-59973","aliases":[],"title":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec(…","description":"FrontMCP is a TypeScript-first framework for the Model Context Protocol (MCP). From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards untrusted OpenAPI url and spec inputs and loadOptions.refResolution to OpenAPIToolGenerator.fromURL() and OpenAPIToolGenerator.fromJSON(). The external $ref guard checks parsed hostname strings without resolving addresses, pinning validated addresses, revalidating redirect targets, or normalizing IPv4-mapped IPv6. An authenticated user who can import or configure an OpenAPI specification in a hosted or multi-user deployment can use DNS-to-loopback resolution, redirect-to-loopback behavior, or IPv4-mapped IPv6 loopback forms to cause backend-origin requests to internal services. This can expose internal administrative APIs, metadata-like services, and other private network endpoints. The practical impact is lower when only a trusted local administrator can configure OpenAPI specs, and disabling external reference protocols prevents the external $ref request. This issue is fixed in mcp-from-openapi 2.5.0 and frontmcp and @frontmcp/adapters 1.5.0.","state":0,"publishedAt":"2026-09-15T16:17:18.327+00:00","modifiedAt":"2026-09-30T17:51:56.193+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":8.5,"severity":"HIGH"}],"references":["https://github.com/agentfront/frontmcp/commit/96a78eaa5c6c4bc51cced557d83d1a03344cb03d","https://github.com/agentfront/frontmcp/pull/496","https://github.com/agentfront/frontmcp/releases/tag/v1.5.0","https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c","https://github.com/agentfront/mcp-from-openapi/commit/be3409cce6e97642696d4ee5a4e4e2712490b277","https://github.com/agentfront/mcp-from-openapi/pull/7","https://github.com/agentfront/mcp-from-openapi/releases/tag/v2.5.0"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59973","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-918"],"productCriteria":[],"sourceDates":{"published":"2026-09-15T16:17:18.327","lastModified":"2026-09-30T17:51:56.193"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-59973","identifiers":["CVE-2026-59973"]},"retained":false,"historicalAffected":[]},{"revision":"ca88c704683347c8b5044612258ebd45","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-65h7-9wrw-629c","aliases":["CVE-2026-59973"],"title":"FrontMCP and mcp-from-openapi have bypass of OpenAPI external $ref SSRF fix","description":"## Summary\n\nThe published fix for GHSA-v6ph-xcq9-qxxj / CVE-2026-39885 added a direct hostname denylist for OpenAPI external `$ref` dereferencing, but the latest patched dependency `mcp-from-openapi` 2.3.0 still makes backend-origin requests to loopback when the target is reached through hostname resolution, redirects, or IPv4-mapped IPv6 syntax.\n\nFrontMCP latest release v1.2.1 and current main still call `OpenAPIToolGenerator.fromURL()` and `OpenAPIToolGenerator.fromJSON()` from `mcp-from-openapi` 2.3.0 when loading OpenAPI adapters. An attacker who can cause a hosted or multi-user FrontMCP deployment to load an untrusted OpenAPI spec can trigger requests from the server to localhost or private services during tool generation.\n\nThis is a latest-version bypass of the previous fix. A direct `http://127.0.0.1` `$ref` control is now denied and produces zero canary hits, while semantically equivalent loopback targets still reach the canary.\n\n## Latest versions checked\n\n- `frontmcp` npm latest: 1.2.1\n- `@frontmcp/adapters` npm latest: 1.2.1\n- `mcp-from-openapi` npm latest: 2.3.0\n- FrontMCP release tag: v1.2.1, commit db323976c66297d684a3e63bbfe1db6b310f2944\n- FrontMCP current main checked: c15b79abe8c6a3cb71d4b7a3bafb8190730dc756\n\nThe release tag and current main both keep `mcp-from-openapi` 2.3.0 in `package.json` and `libs/adapters/package.json`, and both keep the OpenAPI adapter forwarding untrusted `url`, `spec`, and `loadOptions.refResolution` into `OpenAPIToolGenerator`.\n\n## Technical details\n\nFrontMCP's OpenAPI adapter reaches the affected dependency paths:\n\n- `libs/adapters/src/openapi/openapi.adapter.ts` imports `OpenAPIToolGenerator` from `mcp-from-openapi`.\n- `loadOpenAPISpec()` calls `OpenAPIToolGenerator.fromURL(this.options.url, ...)` and forwards `loadOptions.refResolution`.\n- The same method calls `OpenAPIToolGenerator.fromJSON(this.options.spec, ...)` and forwards `loadOptions.refResolution`.\n\nIn `mcp-from-openapi` 2.3.0, the patched guard is applied before the HTTP resolver fetches an external `$ref`. It checks the parsed URL hostname string against deny patterns for direct local and private addresses. The resolver does not resolve hostnames before allow or deny decisions, does not pin the validated IP to the fetch, and does not revalidate redirect targets before following them. It also misses IPv4-mapped IPv6 loopback forms.\n\nAs a result, these URLs are accepted by the guard but cause a loopback request from the backend:\n\n- `http://127.0.0.1.nip.io:<port>/schema.json`, because the hostname string is not a direct IP even though it resolves to 127.0.0.1.\n- `http://127.0.0.1.nip.io:<port>/redirect`, because the first host passes and the actual request follows a redirect to `http://127.0.0.1:<port>/schema.json`.\n- `http://[::ffff:127.0.0.1]:<port>/schema.json` and `http://[::ffff:7f00:1]:<port>/schema.json`, because IPv4-mapped IPv6 loopback is not normalized and denied.\n\n`OpenAPIToolGenerator.fromURL()` is also still unguarded for the initial OpenAPI spec URL. The PoC includes that as supporting evidence, but the primary report is the external `$ref` fix bypass.\n\n## Reproduction\n\nThe attached local PoC starts a loopback canary and loads generated OpenAPI specs using `mcp-from-openapi` 2.3.0. The request body schema contains a single external `$ref` for each test case. The canary records every backend-origin request.\n\nRun:\n\n```bash\ncd /home/unkn0wn/security_audit/frontmcp-ssrf-poc\nnode repro-frontmcp-latest-ssrf-bypasses.mjs\n```\n\nImportant output from a fresh run on 2026-05-25:\n\n```json\n{\"name\":\"direct-127-denied-control\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1:45117/schema.json\",\"ok\":false,\"hitCount\":0,\"hits\":[]}\n{\"name\":\"dns-name-to-127-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null}]}\n{\"name\":\"dns-name-to-127-bypass-with-allowedHosts\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null}]}\n{\"name\":\"redirect-to-127-after-allowed-host\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/redirect\",\"ok\":true,\"hitCount\":2,\"hits\":[{\"url\":\"/redirect\",\"host\":\"127.0.0.1.nip.io:45117\",\"authorization\":null},{\"url\":\"/schema.json\",\"host\":\"127.0.0.1:45117\",\"authorization\":null}]}\n{\"name\":\"ipv4-mapped-ipv6-dotted-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://[::ffff:127.0.0.1]:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"[::ffff:7f00:1]:45117\",\"authorization\":null}]}\n{\"name\":\"ipv4-mapped-ipv6-hex-bypass\",\"kind\":\"external_ref\",\"refUrl\":\"http://[::ffff:7f00:1]:45117/schema.json\",\"ok\":true,\"hitCount\":1,\"hits\":[{\"url\":\"/schema.json\",\"host\":\"[::ffff:7f00:1]:45117\",\"authorization\":null}]}\n{\"name\":\"external-refs-disabled-control\",\"kind\":\"external_ref\",\"refUrl\":\"http://127.0.0.1.nip.io:45117/schema.json\",\"ok\":true,\"hitCount\":0,\"hits\":[]}\n```\n\nControls:\n\n1. Direct loopback `$ref` is denied and the canary records zero requests.\n2. Numeric IPv4 variants tested as parser controls were denied with zero requests.\n3. Default `file://` resolution was denied in this runtime.\n4. Setting `refResolution.allowedProtocols: []` prevents the external request, but this is not the default.\n\n## Impact\n\nThe previous advisory documented SSRF during untrusted OpenAPI `$ref` dereferencing. The latest patched version still lets an attacker trigger backend-origin requests to loopback or private network services through equivalent URL forms. In hosted or multi-user FrontMCP deployments where users can import or configure OpenAPI specs, this can expose internal admin APIs, metadata-like services, and other network endpoints that external users cannot reach directly.\n\nThe impact depends on whether a deployment treats OpenAPI adapter configuration as trusted administrator-only input. If untrusted authenticated users can import specs, this is a high-impact SSRF fix bypass. If only a local administrator can configure OpenAPI specs, the practical severity is lower.\n\n## Remediation\n\n1. Do not rely on parsed hostname denylist checks for external `$ref` URLs.\n2. Resolve hostnames before the request and reject loopback, private, link-local, multicast, unspecified, and metadata ranges.\n3. Normalize IPv4-mapped IPv6 before range checks.\n4. Revalidate every redirect target before following it, or disable redirects during external `$ref` dereferencing.\n5. Pin the validated IP to the actual request with a custom dispatcher, lookup hook, or equivalent connect-time control.\n6. Apply the same protected client to `fromURL()` initial spec loads.\n7. Consider disabling external refs by default for untrusted OpenAPI specs and requiring explicit allowlists.\n8. Add regression tests for direct loopback, DNS-to-loopback, redirect-to-loopback, IPv4-mapped IPv6, numeric IP forms, file refs, and disabled external refs.","state":0,"publishedAt":"2026-09-11T22:02:04+00:00","modifiedAt":"2026-09-11T22:15:04.0090611+00:00","affected":[{"ecosystem":"npm","name":"mcp-from-openapi","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.3.0"},{"kind":"fixed","version":"2.5.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@frontmcp/adapters","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.1"},{"kind":"fixed","version":"1.5.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"frontmcp","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.2.1"},{"kind":"fixed","version":"1.5.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/agentfront/frontmcp/security/advisories/GHSA-65h7-9wrw-629c","https://github.com/agentfront/frontmcp"],"sourceUrl":"https://github.com/advisories/GHSA-65h7-9wrw-629c","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-65h7-9wrw-629c","identifiers":["GHSA-65h7-9wrw-629c","CVE-2026-59973"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0427292+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0427301+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-64752486c567b55b31fb0d7225f5222bcd0019564ac0ac5f0649e242c7b19299-c8f0a5eb97b437649f83f6fe632ec849fcb249052407d33e475e82c88b318dfb","complete":true,"records":424535,"lastAttemptAt":"2026-11-12T02:56:45.3610802+00:00","lastSuccessAt":"2026-11-12T02:56:45.341976+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.3610802+00:00","snapshotPublishedAt":"2026-11-12T02:25:26+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3bce114846604d92838a2dc302341627","complete":false,"records":13760,"lastAttemptAt":"2026-11-12T03:06:53.8778262+00:00","lastSuccessAt":"2026-11-12T03:06:52.8+00:00","error":"754 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-12T03:06:52.8+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13040,"expectedIdentifiers":13813,"failedIdentifiers":754},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-12T02:56:45.8822264+00:00","complete":true,"records":1097,"lastAttemptAt":"2026-11-12T02:56:45.8822264+00:00","lastSuccessAt":"2026-11-12T02:56:46.0434469+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:46.0434471+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-729a419ccc5f41d8a3330c7c6e8b6a5e","complete":true,"records":13760,"lastAttemptAt":"2026-11-12T02:57:11.7691852+00:00","lastSuccessAt":"2026-11-12T02:57:11.766+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:57:11.766+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13813,"expectedIdentifiers":13813,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-3562b6c78fd1bd0f0b55daf66a0926ae24f65e462df7f6d928caad458fc696bf","complete":true,"records":9947,"lastAttemptAt":"2026-11-12T02:56:45.7363501+00:00","lastSuccessAt":"2026-11-11T04:27:43.6877707+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.7363501+00:00","snapshotPublishedAt":"2026-11-11T03:32:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-456002455e0ab94bb92c95476d4e6d175c104cd594749982afd96c893728ecbc","complete":true,"records":2010,"lastAttemptAt":"2026-11-12T02:56:45.5271491+00:00","lastSuccessAt":"2026-11-11T02:36:58.1276999+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.5271491+00:00","snapshotPublishedAt":"2026-11-11T01:17:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-baa8362b4daf9e5f39d5563775a55935e7b442c0735d33274a921579ce4a0d66","complete":true,"records":3093,"lastAttemptAt":"2026-11-12T02:56:45.8443473+00:00","lastSuccessAt":"2026-11-11T13:00:02.5446881+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.8443473+00:00","snapshotPublishedAt":"2026-11-11T12:47:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-685fe7fb2b690656c910a1ea42a9d294e8353311ac8ecfa691a9b0ff1b328804","complete":true,"records":231695,"lastAttemptAt":"2026-11-12T02:56:45.6384803+00:00","lastSuccessAt":"2026-11-11T21:58:47.7265713+00:00","error":null,"lastVerifiedAt":"2026-11-12T02:56:45.6384803+00:00","snapshotPublishedAt":"2026-11-11T21:48:35+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}