{"id":"GHSA-fv66-9v8q-g76r","revision":null,"records":[{"revision":"c53e0652811440ac9ec82919130cc16f","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2025-55182","aliases":[],"title":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-d…","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","state":0,"publishedAt":"2025-12-03T15:40:56.894+00:00","modifiedAt":"2026-10-07T17:58:00.859+00:00","affected":[{"ecosystem":"Vendor product","name":"react-server-dom-webpack","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"react-server-dom-webpack\",\n                    \"vendor\": \"Meta\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"19.0.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.1.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.1.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.2.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.2.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-server-dom-turbopack","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"react-server-dom-turbopack\",\n                    \"vendor\": \"Meta\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"19.0.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.1.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.1.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.2.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.2.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"react-server-dom-parcel","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"defaultStatus\": \"unaffected\",\n                    \"product\": \"react-server-dom-parcel\",\n                    \"vendor\": \"Meta\",\n                    \"versions\": [\n                        {\n                            \"lessThanOrEqual\": \"19.0.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.0.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.1.1\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.1.0\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"lessThanOrEqual\": \"19.2.0\",\n                            \"status\": \"affected\",\n                            \"version\": \"19.2.0\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":"CRITICAL"}],"references":["https://www.facebook.com/security/advisories/cve-2025-55182","https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2025-55182","license":"CVE Program Terms of Use","key":"cve-program:CVE-2025-55182","identifiers":["CVE-2025-55182"]},"retained":false,"historicalAffected":[]},{"revision":"efe37fe7736c4794bc094b00d7383d3b","observedAt":"2026-11-09T03:11:13.255+00:00","statement":{"source":"euvd","id":"EUVD-2025-200983","aliases":["CVE-2025-55182","GHSA-fv66-9v8q-g76r"],"title":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-d…","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":null}],"references":["https://www.facebook.com/security/advisories/cve-2025-55182","https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-200983","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Dec 3, 2025, 3:40:56 PM","dateUpdated":"Oct 7, 2026, 5:58:00 PM"},"relatedAdvisories":[{"id":"cisco-sa-react-flight-TYw32Ddb","title":"Remote Code Execution Vulnerability in React and Next.js Frameworks: December 2025","vulnerabilityIds":["CVE-2025-55182"]},{"id":"NCSC-2025-0380","title":"Kwetsbaarheden verholpen in React Server Components","vulnerabilityIds":["CVE-2025-55182","CVE-2025-66478"]},{"id":"WID-SEC-W-2025-2738","title":"Vercel Next.js und React Server Components (React2Shell): Schwachstelle ermöglicht Codeausführung","vulnerabilityIds":["CVE-2025-55182","CVE-2025-66478"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2025-200983","identifiers":["EUVD-2025-200983","CVE-2025-55182","GHSA-fv66-9v8q-g76r"]},"retained":false,"historicalAffected":[]},{"revision":"7da6db5b5a7c4043b2f2eec7a41b12cc","observedAt":"2026-10-25T03:17:11.863+00:00","statement":{"source":"nvd","id":"CVE-2025-55182","aliases":[],"title":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-d…","description":"A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints.","state":0,"publishedAt":"2025-12-03T16:15:56.463+00:00","modifiedAt":"2026-10-18T17:10:00.11+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · cve-assign@fb.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":10,"severity":"CRITICAL"}],"references":["https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","https://www.facebook.com/security/advisories/cve-2025-55182","http://www.openwall.com/lists/oss-security/2025/12/03/4","https://news.ycombinator.com/item?id=46136026","https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/","https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-55182"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-55182","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-502"],"productCriteria":["cpe:2.3:a:facebook:react:19.0.0:*:*:*:*:*:*:*","cpe:2.3:a:facebook:react:19.1.0:*:*:*:*:*:*:*","cpe:2.3:a:facebook:react:19.1.1:*:*:*:*:*:*:*","cpe:2.3:a:facebook:react:19.2.0:*:*:*:*:*:*:*","cpe:2.3:a:vercel:next.js:*:*:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary77:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary78:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary79:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary80:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary81:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary82:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary83:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary84:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary85:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary86:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:14.3.0:canary87:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:-:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary0:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary1:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary10:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary11:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary12:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary13:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary14:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary15:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary16:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary17:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary18:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary19:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary2:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary20:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary21:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary22:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary23:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary24:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary25:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary26:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary27:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary28:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary29:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary3:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary30:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary31:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary32:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary33:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary34:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary35:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary36:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary37:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary38:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary39:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary4:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary40:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary41:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary42:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary43:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary44:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary45:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary46:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary47:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary48:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary49:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary5:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary50:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary51:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary52:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary53:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary54:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary55:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary56:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary57:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary6:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary7:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary8:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:15.6.0:canary9:*:*:*:node.js:*:*","cpe:2.3:a:vercel:next.js:16.0.0:-:*:*:*:node.js:*:*"],"sourceDates":{"published":"2025-12-03T16:15:56.463","lastModified":"2026-10-18T17:10:00.110"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2025-55182","identifiers":["CVE-2025-55182"]},"retained":false,"historicalAffected":[]},{"revision":"a8dc5f6dfe204fb78288faa194de84e7","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-fv66-9v8q-g76r","aliases":["CVE-2025-55182"],"title":"React Server Components are Vulnerable to RCE","description":"### Impact\n\nThere is an unauthenticated remote code execution vulnerability in React Server Components.\n\nWe recommend upgrading immediately.\n\nThe vulnerability is present in versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 of:\n* [react-server-dom-webpack](https://www.npmjs.com/package/react-server-dom-webpack)\n* [react-server-dom-parcel](https://www.npmjs.com/package/react-server-dom-parcel)\n* [react-server-dom-turbopack](https://www.npmjs.com/package/react-server-dom-turbopack?activeTab=readme)\n\n### Patches\n\nA fix was introduced in versions [19.0.1](https://github.com/facebook/react/releases/tag/v19.0.1), [19.1.2](https://github.com/facebook/react/releases/tag/v19.1.2), and [19.2.1](https://github.com/facebook/react/releases/tag/v19.2.1). If you are using any of the above packages please upgrade to any of the fixed versions immediately.\n\nIf your app’s React code does not use a server, your app is not affected by this vulnerability. If your app does not use a framework, bundler, or bundler plugin that supports React Server Components, your app is not affected by this vulnerability.\n\n### References\n\nSee the [blog post](https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components) for more information and upgrade instructions.","state":0,"publishedAt":"2025-12-03T19:07:39+00:00","modifiedAt":"2025-12-09T17:46:07.154758+00:00","affected":[{"ecosystem":"npm","name":"react-server-dom-webpack","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.0.0"},{"kind":"fixed","version":"19.0.1"}]}],"versions":["19.0.0"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-webpack","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.1.0"},{"kind":"fixed","version":"19.1.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-webpack","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.2.0"},{"kind":"fixed","version":"19.2.1"}]}],"versions":["19.2.0"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-turbopack","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.0.0"},{"kind":"fixed","version":"19.0.1"}]}],"versions":["19.0.0"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-turbopack","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.1.0"},{"kind":"fixed","version":"19.1.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-turbopack","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.2.0"},{"kind":"fixed","version":"19.2.1"}]}],"versions":["19.2.0"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-parcel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.0.0"},{"kind":"fixed","version":"19.0.1"}]}],"versions":["19.0.0"],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-parcel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.1.0"},{"kind":"fixed","version":"19.1.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"react-server-dom-parcel","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"19.2.0"},{"kind":"fixed","version":"19.2.1"}]}],"versions":["19.2.0"],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/facebook/react/security/advisories/GHSA-fv66-9v8q-g76r","https://nvd.nist.gov/vuln/detail/CVE-2025-55182","https://github.com/facebook/react/pull/35277","https://github.com/facebook/react/commit/7dc903cd29dac55efb4424853fd0442fef3a8700","https://github.com/ejpir/CVE-2025-55182-poc","https://github.com/facebook/react","https://github.com/facebook/react/releases/tag/v19.0.1","https://github.com/facebook/react/releases/tag/v19.1.2","https://github.com/facebook/react/releases/tag/v19.2.1","https://news.ycombinator.com/item?id=46136026","https://react.dev/blog/2025/12/03/critical-security-vulnerability-in-react-server-components","https://www.facebook.com/security/advisories/cve-2025-55182","http://www.openwall.com/lists/oss-security/2025/12/03/4"],"sourceUrl":"https://github.com/advisories/GHSA-fv66-9v8q-g76r","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-fv66-9v8q-g76r","identifiers":["GHSA-fv66-9v8q-g76r","CVE-2025-55182"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-09T06:02:15.5744295+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-09T06:02:15.5744295+00:00","lastSuccessAt":"2026-11-09T06:02:15.8100724+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.8100756+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-24e6fde7b744113daefb8f6135035fb8a5c69c9617c9c0d40574a0376532ffd3-61bf15172f364246efc204ad9b25e3f89710939e13c23b3efb3d009b5fdad808","complete":true,"records":421290,"lastAttemptAt":"2026-11-09T06:02:14.4940664+00:00","lastSuccessAt":"2026-11-09T05:02:14.5253969+00:00","error":"HttpRequestException","lastVerifiedAt":"2026-11-09T05:02:14.5383867+00:00","snapshotPublishedAt":"2026-11-09T04:29:38+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-52f0bd58a8564ba89a1952b43ef3bc92","complete":false,"records":13654,"lastAttemptAt":"2026-11-09T06:14:09.0160642+00:00","lastSuccessAt":"2026-11-09T06:14:09.013+00:00","error":"8 identifier lookups failed; latest failures include HTTP 403. Other identifiers were checked independently.","lastVerifiedAt":"2026-11-09T06:14:09.013+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13674,"expectedIdentifiers":13706,"failedIdentifiers":8},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-09T06:02:15.5744295+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-09T06:02:15.5744295+00:00","lastSuccessAt":"2026-11-09T06:02:15.8108397+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.81084+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-5a44a451442747cb81d83104fe1e7771","complete":true,"records":13666,"lastAttemptAt":"2026-11-09T06:02:16.371904+00:00","lastSuccessAt":"2026-11-09T02:08:52.274+00:00","error":null,"lastVerifiedAt":"2026-11-09T02:08:52.274+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-09T06:02:15.5156789+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.5156789+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-09T06:02:14.6970768+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:14.6970768+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f6d341f4320a5a0c059c28102ee651c3dd06abc87b84d2bafa4e2a823ec07d35","complete":true,"records":3056,"lastAttemptAt":"2026-11-09T06:02:15.5284383+00:00","lastSuccessAt":"2026-11-09T05:02:23.1539412+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.5284383+00:00","snapshotPublishedAt":"2026-11-09T04:47:48+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-6a1c845b1938b1aa788f0e95c9ac8a8d5a1f07caed5d155840b0616b548c1455","complete":true,"records":231296,"lastAttemptAt":"2026-11-09T06:02:15.4064738+00:00","lastSuccessAt":"2026-11-09T04:03:49.859595+00:00","error":null,"lastVerifiedAt":"2026-11-09T06:02:15.4064738+00:00","snapshotPublishedAt":"2026-11-09T03:33:06+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}