{"id":"EUVD-2026-81298","revision":null,"records":[{"revision":"5f78235f677845c197304d69022f0d31","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-92598","aliases":[],"title":"Nodemailer before 9.1.0 IDN/Punycode Domain Allow-list Bypass","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","state":0,"publishedAt":"2026-09-16T21:47:02.365+00:00","modifiedAt":"2026-09-17T14:43:20.281+00:00","affected":[{"ecosystem":"Vendor product","name":"nodemailer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nodemailer\",\n                    \"product\": \"nodemailer\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/nodemailer\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"9.1.0\"\n                        },\n                        {\n                            \"version\": \"9.1.0\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","score":8.3,"severity":"HIGH"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/commit/259c32d","https://github.com/nodemailer/nodemailer/commit/b212ac4","https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-92598","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-92598","identifiers":["CVE-2026-92598"]},"retained":false,"historicalAffected":[]},{"revision":"1ffa2a67117641459ec951c89d10ff4c","observedAt":"2026-11-11T18:10:21.682+00:00","statement":{"source":"euvd","id":"EUVD-2026-81298","aliases":["CVE-2026-92598","GHSA-r7q5-h7cx-p54x"],"title":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addres…","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N","score":8.3,"severity":null}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/commit/259c32d","https://github.com/nodemailer/nodemailer/commit/b212ac4","https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-81298","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 16, 2026, 9:47:02 PM","dateUpdated":"Sep 17, 2026, 2:43:20 PM"},"relatedAdvisories":[{"id":"WID-SEC-W-2026-3621","title":"IBM App Connect Enterprise: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2022-35948","CVE-2026-13697","CVE-2026-14643","CVE-2026-15157","CVE-2026-1527","CVE-2026-16728","CVE-2026-16729","CVE-2026-59871","CVE-2026-59873","CVE-2026-59874","CVE-2026-59875","CVE-2026-92595","CVE-2026-92596","CVE-2026-92597","CVE-2026-92598","CVE-2026-9678"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-81298","identifiers":["EUVD-2026-81298","CVE-2026-92598","GHSA-r7q5-h7cx-p54x"]},"retained":false,"historicalAffected":[]},{"revision":"a1e5cf1e863445778194667e06bfb1b9","observedAt":"2026-10-25T16:19:22.228+00:00","statement":{"source":"nvd","id":"CVE-2026-92598","aliases":[],"title":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addres…","description":"Nodemailer before 9.1.0 fails to apply UTS-46 normalization when encoding international domain names, causing the domain resolver to compute a different Punycode A-label than standards-compliant parsers. Attackers can craft recipient addresses with invisible characters or compatibility mappings that pass domain allow-list checks but are delivered to attacker-controlled domains via SMTP.","state":0,"publishedAt":"2026-09-16T22:18:30.84+00:00","modifiedAt":"2026-09-22T20:25:55.87+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.3,"severity":"HIGH"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","score":6.5,"severity":"MEDIUM"}],"references":["https://github.com/nodemailer/nodemailer/commit/259c32d","https://github.com/nodemailer/nodemailer/commit/b212ac4","https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://www.vulncheck.com/advisories/nodemailer-before-9.1.0-idn-punycode-domain-allow-list-bypass"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-92598","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-436"],"productCriteria":[],"sourceDates":{"published":"2026-09-16T22:18:30.840","lastModified":"2026-09-22T20:25:55.870"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-92598","identifiers":["CVE-2026-92598"]},"retained":false,"historicalAffected":[]},{"revision":"f9d6a530971e452690caeba4c614aa18","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wmmp-3585-3rmp","aliases":["CVE-2026-92598"],"title":"Nodemailer: IDN/Punycode domain allow-list bypass leads to email delivery to an attacker-controlled domain","description":"### Summary\n\nNodemailer resolves an international (IDN / non-ASCII) recipient **domain** to a different Punycode `xn--` label than every UTS‑46‑conformant parser (web browsers, the WHATWG URL Standard, Node's `url.domainToASCII`, Python's `idna`). Its address normalizer (`_normalizeAddress` in `lib/mime-node/index.js`) uses the bundled **raw RFC‑3492 Punycode codec with no UTS‑46 mapping/normalization**, so a domain that a standards‑compliant validator maps to a trusted domain is delivered by Nodemailer to a **different, attacker‑registrable domain**.\n\nAn application that applies a domain allow‑list / same‑domain check to a recipient using a normal IDN‑aware parser (or that shows the normalized recipient to a user for confirmation) and then relies on Nodemailer to deliver to that domain can be induced to send email to an **unintended external domain**. This is the same weakness class as CVE‑2025‑13033 (Interpretation Conflict, CWE‑436) but reached through IDN/Punycode rather than quoted local‑parts, and it is not addressed by the 7.0.7 fix.\n\nBecause the mismatch can be triggered with an **invisible** character (U+00AD SOFT HYPHEN) that UTS‑46 folds away to the *exact* trusted domain string, no visible look‑alike/homograph is required.\n\n### Details\n\n`lib/mime-node/index.js` → `_normalizeAddress(address)` (around lines 1307–1346) splits the address at the last `@` and normalizes the domain like this:\n\n```js\n// lib/mime-node/index.js\ntry {\n    if (/[\\x80-\uFFFF]/.test(user)) {\n        encodedDomain = punycode.toUnicode(domain.toLowerCase());   // line ~1338\n    } else {\n        encodedDomain = punycode.toASCII(domain.toLowerCase());     // line ~1340\n    }\n} catch (_err) {\n    // keep domain as supplied\n}\nreturn `${this._normalizeLocalPart(user)}@${encodedDomain}`;         // line ~1346\n```\n\n`punycode` here is the project’s bundled codec (`lib/punycode/`), which is a **pure RFC 3492 (Punycode) implementation**. The only normalization applied to the domain is `.toLowerCase()`. It performs **none of the UTS‑46 “IDNA2008 + compatibility processing” steps** that browsers and DNS‑facing resolvers apply before Punycode encoding, specifically:\n\n* removing **Ignored** code points such as `U+00AD` SOFT HYPHEN,\n* **Mapping** full‑width / compatibility characters to their canonical ASCII forms,\n* Unicode **NFC** normalization,\n* validity checks.\n\nAs a result, for any domain containing a UTS‑46‑mapped or ‑ignored character, Nodemailer’s `punycode.toASCII(...)` produces a **different A‑label** than `url.domainToASCII(...)` (Node ≥ 7 / WHATWG), `new URL('http://'+domain)`, browsers, and Python’s `idna` (`uts46=True`). Nodemailer then uses its A‑label as:\n\n* the SMTP envelope recipient written to the wire as `RCPT TO:<local@xn--…>` (`getEnvelope()` → `lib/smtp-connection/index.js` `_setEnvelope`), **and**\n* the address emitted in the `To:` / `From:` headers (`_convertAddresses`).\n\nSo the domain a standards‑compliant validator computes and the domain Nodemailer actually delivers to **disagree**, on a syntactically valid, validator‑accepted address. Concrete divergences (verified on 9.0.6):\n\n| recipient (raw) | UTS‑46 parser (`url.domainToASCII`) | Nodemailer delivers to |\n|---|---|---|\n| `victim@compa{U+00AD}ny.com` (invisible soft hyphen) | `company.com` | `xn--company-pka.com` |\n| `victim@ｃｏｍｐａｎｙ.com` (full‑width) | `company.com` | `xn--mi7cd4afch9d.com` |\n| `user@exámple.com` (NFD `a`+U+0301) | `xn--exmple-qta.com` | `xn--example-vge.com` |\n\nThis is the “Punycode / IDN parser discrepancy” technique documented in PortSwigger’s *Splitting the email atom* research (which produced e.g. Joomla CVE‑2024‑21725 and fixes in the PHP `idna_convert` library). The fix for CVE‑2025‑13033 (nodemailer 7.0.7) hardened the *quoted‑local‑part* path only; this IDN path is independent and still present in **9.0.6 (latest)** and, given the long‑standing use of the bundled RFC‑3492 codec, earlier releases.\n\n**Suggested remediation:** perform UTS‑46 processing before/at domain encoding so Nodemailer’s resolution matches browsers, validators, and DNS — e.g. use the runtime’s `url.domainToASCII()` (available since Node 7) instead of the raw `punycode.toASCII`, and decode with the matching UTS‑46 `domainToUnicode`. At minimum, reject a domain whose value changes under UTS‑46 mapping (i.e. `punycode.toASCII(d)` ≠ `url.domainToASCII(d)`).\n\n### PoC\n\nEnvironment: Node.js ≥ 18, the published `nodemailer@9.0.6`. No special configuration; the discrepancy is in domain normalization itself.\n\n`poc-idn.js`:\n\n```js\n'use strict';\nconst net = require('net');\nconst url = require('url');\nconst nodemailer = require('nodemailer'); // 9.0.6\n\nconst TRUSTED   = 'company.com';                        // the only domain the app will mail\nconst RECIPIENT = 'victim@compa\\u00ADny.com';           // attacker input: invisible U+00AD inside \"company\"\n\n// The app's domain allow-list check, done the standard (UTS-46 / browser / WHATWG) way:\nconst seen = url.domainToASCII(RECIPIENT.split('@').pop());\nconsole.log('validator (url.domainToASCII) sees:', JSON.stringify(seen),\n            seen === TRUSTED ? '=> ALLOWED (equals trusted domain)' : '');\n\n// A tiny SMTP sink that prints the literal RCPT TO Nodemailer transmits:\nconst server = net.createServer(sock => {\n  let buf = ''; sock.write('220 sink\\r\\n');\n  sock.on('data', d => { buf += d; let i;\n    while ((i = buf.indexOf('\\r\\n')) >= 0) { const line = buf.slice(0, i); buf = buf.slice(i + 2);\n      const u = line.toUpperCase();\n      if (u.startsWith('EHLO')) sock.write('250-sink\\r\\n250 8BITMIME\\r\\n');\n      else if (u.startsWith('RCPT')) { console.log('nodemailer transmits             :', line); sock.write('250 ok\\r\\n'); }\n      else if (u.startsWith('DATA')) sock.write('354 go\\r\\n');\n      else if (line === '.') sock.write('250 ok\\r\\n');\n      else if (u.startsWith('QUIT')) { sock.write('221 bye\\r\\n'); sock.end(); }\n      else sock.write('250 ok\\r\\n'); } });\n});\nserver.listen(0, '127.0.0.1', async () => {\n  const t = nodemailer.createTransport({ host: '127.0.0.1', port: server.address().port, secure: false });\n  await t.sendMail({ from: 'app@company.com', to: RECIPIENT, subject: 'reset your password', text: 'secret link' });\n  t.close(); server.close();\n});\n```\n\nRun:\n\n```\nnpm init -y && npm install nodemailer@9.0.6\nnode poc-idn.js\n```\n\nActual output (Nodemailer 9.0.6):\n\n```\nvalidator (url.domainToASCII) sees: \"company.com\" => ALLOWED (equals trusted domain)\nnodemailer transmits             : RCPT TO:<victim@xn--company-pka.com>\n```\n\nThe application’s domain check approves `company.com`, but the message is sent to `xn--company-pka.com` — a **different domain an attacker can register** — carrying the `To:` header `<victim@xn--company-pka.com>` as well.\n\nA containerized version that proves the same result against a **real RFC 5321 SMTP server** (`aiosmtpd`) is included alongside this report (`docker compose up --build`, cases `R6`/IDN); the receiving server accepts `RCPT TO:<victim@xn--company-pka.com>` and reports the recipient domain as `xn--company-pka.com`.\n\n### Impact\n\nAny application that uses Nodemailer to send mail to a recipient whose domain is subjected to a security or trust decision made with a *different* (UTS‑46‑conformant) parser, and then trusts Nodemailer to deliver to that domain. This includes:\n  * recipient **allow‑list / block‑list / “same corporate domain” checks** implemented with `new URL()`, `url.domainToASCII`, a browser‑side check, or an IDN library;\n  * flows that **display or log the normalized recipient domain** for human confirmation (the shown `company.com` differs from the delivered `xn--company-pka.com`);\n  * any domain‑gated feature (employee‑only registration, “send only to our tenant”, notification routing).\n\n## Patched in 9.1.0\n\nDomain encoding now applies UTS-46 ([259c32d](https://github.com/nodemailer/nodemailer/commit/259c32d)), so `victim@compa­ny.com` resolves to `company.com`, matching `url.domainToASCII` and browsers.\n\nOne caveat on the suggested remediation, hardened in [b212ac4](https://github.com/nodemailer/nodemailer/commit/b212ac4): `url.domainToASCII` is a WHATWG **host parser**, not a pure UTS-46 mapper. It terminates the host at `/`, `\\\\`, `?` and `#` and percent-decodes. Used unguarded it introduces a worse version of the same weakness, since `user@attacker.example/mail.corp.example` encodes to the deliverable `user@attacker.example` where the bundled Punycode codec left it intact and unroutable. Those characters are now kept away from the mapper.\n\nOn severity, \"attacker-registrable\" is doing significant work in the report: `xn--company-pka.com` decodes to a label containing U+00AD and `xn--mi7cd4afch9d.com` to full-width Latin, neither of which Verisign's IDN tables permit for a .com registration. The misdelivery and the confirmation-UI mismatch stand regardless, which is why this is rated level with the comment issue rather than above it.","state":0,"publishedAt":"2026-09-08T21:33:32+00:00","modifiedAt":"2026-09-17T11:56:00.2749081+00:00","affected":[{"ecosystem":"npm","name":"nodemailer","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"9.1.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wmmp-3585-3rmp","https://github.com/nodemailer/nodemailer/pull/1848","https://github.com/nodemailer/nodemailer/commit/259c32d7d266301e3377a212776c3fff993c0148","https://github.com/nodemailer/nodemailer/commit/b212ac4e27bce8182478044fcb8d1642ccdad46e","https://github.com/nodemailer/nodemailer","https://github.com/nodemailer/nodemailer/releases/tag/v9.1.0"],"sourceUrl":"https://github.com/advisories/GHSA-wmmp-3585-3rmp","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wmmp-3585-3rmp","identifiers":["GHSA-wmmp-3585-3rmp","CVE-2026-92598"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6882289+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.688234+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-98121ba726768336a864ab5bced2f3860f36459d7555a27229b152c25d7e1f39","complete":true,"records":424942,"lastAttemptAt":"2026-11-13T03:16:36.8593016+00:00","lastSuccessAt":"2026-11-13T03:16:36.8357038+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:16:36.8593016+00:00","snapshotPublishedAt":"2026-11-13T02:30:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-7f404f09616a40578b159775b5b66635","complete":false,"records":13793,"lastAttemptAt":"2026-11-13T03:29:27.9813623+00:00","lastSuccessAt":"2026-11-13T03:29:27.977+00:00","error":"370 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T03:29:27.977+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13369,"expectedIdentifiers":13846,"failedIdentifiers":370},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T03:19:40.5269590+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T03:19:40.526959+00:00","lastSuccessAt":"2026-11-13T03:19:40.6892892+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.6892894+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-99b329e58ea7441eaabf9a9af1bb4458","complete":true,"records":13781,"lastAttemptAt":"2026-11-13T03:19:48.7349646+00:00","lastSuccessAt":"2026-11-13T03:19:48.73+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:48.73+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13846,"expectedIdentifiers":13846,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T03:19:40.4671686+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4671686+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T03:16:36.9337406+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:16:36.9337406+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-20d1a8ab073a1c13ab2143dbcadb34ebb8edf1e18e16482b448513662c3d1e12","complete":true,"records":3127,"lastAttemptAt":"2026-11-13T03:19:40.4889465+00:00","lastSuccessAt":"2026-11-12T22:18:31.0338213+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.4889465+00:00","snapshotPublishedAt":"2026-11-12T22:18:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-11714c374501e9f6ac09cc4e36bc0b50c7521131f606050aeabd7887ba2c0080","complete":true,"records":231743,"lastAttemptAt":"2026-11-13T03:19:40.3437235+00:00","lastSuccessAt":"2026-11-13T03:19:38.55958+00:00","error":null,"lastVerifiedAt":"2026-11-13T03:19:40.3437235+00:00","snapshotPublishedAt":"2026-11-13T02:48:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}