{"id":"GHSA-gwhp-pf74-vj37","revision":null,"records":[{"revision":"d62364d84d194a69a6a8f5ebe4c6a5d4","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-33805","aliases":[],"title":"@fastify/reply-from vulnerable to connection header abuse enabling stripping of proxy-added headers","description":"@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. \n\nUpgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.","state":0,"publishedAt":"2026-04-15T10:13:25.147+00:00","modifiedAt":"2026-07-15T01:06:04.635+00:00","affected":[{"ecosystem":"Vendor product","name":"@fastify/reply-from","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@fastify/reply-from\",\n                    \"product\": \"@fastify/reply-from\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"12.6.2\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"12.6.2\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/@fastify/reply-from\"\n                }"},{"ecosystem":"Vendor product","name":"@fastify/http-proxy","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"@fastify/reply-from\",\n                    \"product\": \"@fastify/http-proxy\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"versions\": [\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"affected\",\n                            \"version\": \"0\",\n                            \"lessThan\": \"11.4.4\"\n                        },\n                        {\n                            \"versionType\": \"semver\",\n                            \"status\": \"unaffected\",\n                            \"version\": \"11.4.4\"\n                        }\n                    ],\n                    \"packageURL\": \"pkg:npm/@fastify/http-proxy\"\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","score":9,"severity":"CRITICAL"}],"references":["https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-33805","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-33805","identifiers":["CVE-2026-33805"]},"retained":false,"historicalAffected":[]},{"revision":"288a4906a9ba48ecb9ba1d2c8f09f691","observedAt":"2026-11-01T05:16:03.81+00:00","statement":{"source":"euvd","id":"EUVD-2026-22877","aliases":["CVE-2026-33805"],"title":"@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip pro…","description":"@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. \n\nUpgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","score":9,"severity":null}],"references":["https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37","https://cna.openjsf.org/security-advisories.html"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-22877","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Apr 15, 2026, 10:13:25 AM","dateUpdated":"Jul 15, 2026, 1:06:04 AM"},"relatedAdvisories":[{"id":"RHSA-2026:10175","title":"Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.27.1 Release.","vulnerabilityIds":["CVE-2025-61728","CVE-2025-62718","CVE-2026-2332","CVE-2026-4800","CVE-2026-4926","CVE-2026-22731","CVE-2026-25679","CVE-2026-26999","CVE-2026-27137","CVE-2026-27606","CVE-2026-29054","CVE-2026-32305","CVE-2026-32695","CVE-2026-33186","CVE-2026-33433","CVE-2026-33805","CVE-2026-33870","CVE-2026-33871","CVE-2026-33937","CVE-2026-33938","CVE-2026-33939","CVE-2026-33940","CVE-2026-33941","CVE-2026-34986","CVE-2026-40175"]},{"id":"RHSA-2026:87410","title":"Red Hat Security Advisory: RHOAI 2.25.12 - Red Hat OpenShift AI","vulnerabilityIds":["CVE-2024-12224","CVE-2025-14920","CVE-2025-14921","CVE-2025-14924","CVE-2025-14925","CVE-2025-14926","CVE-2025-14927","CVE-2025-14928","CVE-2025-14929","CVE-2025-14930","CVE-2025-61726","CVE-2025-61729","CVE-2026-5241","CVE-2026-5497","CVE-2026-6734","CVE-2026-8643","CVE-2026-9697","CVE-2026-11822","CVE-2026-11824","CVE-2026-12151","CVE-2026-12860","CVE-2026-15143","CVE-2026-15574","CVE-2026-15679","CVE-2026-15925","CVE-2026-16221","CVE-2026-18427","CVE-2026-18446","CVE-2026-18949","CVE-2026-19481","CVE-2026-19484","CVE-2026-19534","CVE-2026-25681","CVE-2026-25960","CVE-2026-27136","CVE-2026-28390","CVE-2026-28684","CVE-2026-31812","CVE-2026-32283","CVE-2026-33186","CVE-2026-33805","CVE-2026-33811","CVE-2026-33814","CVE-2026-34993","CVE-2026-39821","CVE-2026-39852","CVE-2026-39892","CVE-2026-40682","CVE-2026-41178","CVE-2026-42502","CVE-2026-42561","CVE-2026-44431","CVE-2026-44432","CVE-2026-44660","CVE-2026-44705","CVE-2026-45820","CVE-2026-47219","CVE-2026-48526","CVE-2026-48710","CVE-2026-48746","CVE-2026-49114","CVE-2026-49825","CVE-2026-49855","CVE-2026-50559","CVE-2026-54283","CVE-2026-54399","CVE-2026-54428","CVE-2026-55831","CVE-2026-55833","CVE-2026-56121","CVE-2026-56746","CVE-2026-56819","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-58059","CVE-2026-59296","CVE-2026-59879","CVE-2026-59884","CVE-2026-59885","CVE-2026-59886","CVE-2026-59899","CVE-2026-62243","CVE-2026-62384","CVE-2026-63209","CVE-2026-63374","CVE-2026-65898","CVE-2026-65918","CVE-2026-66007","CVE-2026-67213","CVE-2026-67214","CVE-2026-67312","CVE-2026-68494","CVE-2026-68497","CVE-2026-68770","CVE-2026-69097","CVE-2026-69112","CVE-2026-69152","CVE-2026-69153","CVE-2026-69243","CVE-2026-69244","CVE-2026-71281","CVE-2026-73086","CVE-2026-73088","CVE-2026-73089","CVE-2026-73415","CVE-2026-73417","CVE-2026-73502","CVE-2026-73508","CVE-2026-73620","CVE-2026-73622","CVE-2026-73623","CVE-2026-73624","CVE-2026-73625","CVE-2026-73627","CVE-2026-73646","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76098","CVE-2026-76169","CVE-2026-76172","CVE-2026-76222","CVE-2026-76905","CVE-2026-77354","CVE-2026-77874","CVE-2026-78676","CVE-2026-78677","CVE-2026-78679","CVE-2026-78682","CVE-2026-79674","CVE-2026-79675","CVE-2026-80205","CVE-2026-81722","CVE-2026-81724","CVE-2026-81727","CVE-2026-82397","CVE-2026-82417","CVE-2026-84292","CVE-2026-84375","CVE-2026-84394","CVE-2026-84428","CVE-2026-84445","CVE-2026-84469","CVE-2026-84504","CVE-2026-84782","CVE-2026-84961","CVE-2026-85124","CVE-2026-85152","CVE-2026-85525","CVE-2026-86049","CVE-2026-86332","CVE-2026-87776","CVE-2026-87817","CVE-2026-87819","CVE-2026-88029","CVE-2026-88031","CVE-2026-89418","CVE-2026-89425","CVE-2026-91777","CVE-2026-91990","CVE-2026-92599","CVE-2026-93599","CVE-2026-93657","CVE-2026-93749","CVE-2026-96749","CVE-2026-102831","CVE-2026-102925","CVE-2026-102930","CVE-2026-102937","CVE-2026-102938","CVE-2026-103262","CVE-2026-104851","CVE-2026-105744"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-22877","identifiers":["EUVD-2026-22877","CVE-2026-33805"]},"retained":false,"historicalAffected":[]},{"revision":"2086a6847ce74d5a92093e9c8eb95ced","observedAt":"2026-10-27T09:02:55.767+00:00","statement":{"source":"nvd","id":"CVE-2026-33805","aliases":[],"title":"@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip pro…","description":"@fastify/reply-from v12.6.1 and earlier and @fastify/http-proxy v11.4.3 and earlier process the client's Connection header after the proxy has added its own headers via rewriteRequestHeaders. This allows attackers to retroactively strip proxy-added headers from upstream requests by listing them in the Connection header value. Any header added by the proxy for routing, access control, or security purposes can be selectively removed by a client. @fastify/http-proxy is also affected as it delegates to @fastify/reply-from. \n\nUpgrade to @fastify/reply-from v12.6.2 or @fastify/http-proxy v11.4.4 or later.","state":0,"publishedAt":"2026-04-15T11:16:34.99+00:00","modifiedAt":"2026-10-26T22:10:00.163+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · ce714d77-add3-4f53-aff5-83d477b104bb · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":9,"severity":"CRITICAL"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","score":8.6,"severity":"HIGH"},{"system":"CVSS 3.1 · 0b0ca135-0b70-47e7-9f44-1890c2a1c46c · Secondary","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","score":7.4,"severity":"HIGH"}],"references":["https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37","https://access.redhat.com/errata/RHSA-2026:10175","https://access.redhat.com/security/cve/CVE-2026-33805","https://bugzilla.redhat.com/show_bug.cgi?id=2458651","https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33805.json"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-33805","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-644","CWE-444"],"productCriteria":["cpe:2.3:a:fastify:fastify\\/http-proxy:*:*:*:*:*:node.js:*:*","cpe:2.3:a:fastify:reply-from:*:*:*:*:*:node.js:*:*"],"sourceDates":{"published":"2026-04-15T11:16:34.990","lastModified":"2026-10-26T22:10:00.163"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-33805","identifiers":["CVE-2026-33805"]},"retained":false,"historicalAffected":[]},{"revision":"8e02878c66404ca6ad8aefcb05161093","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-gwhp-pf74-vj37","aliases":["CVE-2026-33805"],"title":"Fastify's connection header abuse enables stripping of proxy-added headers","description":"### Summary\n\n`@fastify/reply-from` and `@fastify/http-proxy` process the client's `Connection` header after the proxy has added its own headers via `rewriteRequestHeaders`. This allows attackers to retroactively strip proxy-added headers (like access control or identification headers) from upstream requests by listing them in the `Connection` header value. This affects applications using these plugins with custom header injection for routing, access control, or security purposes.\n\n### Details\n\nThe vulnerability exists in `@fastify/reply-from/lib/request.js` at lines 128-136 (HTTP/1.1 handler) and lines 191-200 (undici handler). The processing flow is:\n\n1. Client headers are copied including the `connection` header (`@fastify/reply-from/index.js` line 91)\n2. The proxy adds custom headers via `rewriteRequestHeaders` (line 151)\n3. During request construction, the transport handlers read the client's `Connection` header and strip any headers listed in it\n4. This stripping happens after `rewriteRequestHeaders`, allowing clients to target proxy-added headers for removal\n\nRFC 7230 Section 6.1 Connection header processing is intended for proxies to strip hop-by-hop headers from incoming requests before adding their own headers. The current implementation reverses this order, processing the client's Connection header after the proxy has already modified the header set.\n\nThe call chain:\n1. `@fastify/reply-from/index.js` line 91: `headers = { ...req.headers }` — copies ALL client headers including `connection`\n2. `index.js` line 151: `requestHeaders = rewriteRequestHeaders(this.request, headers)` — proxy adds custom headers (e.g., `x-forwarded-by`)\n3. `index.js` line 180: `requestImpl({...headers: requestHeaders...})` — passes headers to transport\n4. `request.js` line 191 (undici): `getConnectionHeaders(req.headers)` — reads Connection header FROM THE CLIENT\n5. `request.js` lines 198-200: Strips headers listed in Connection — including proxy-added headers\n\nThis is distinct from the general hop-by-hop forwarding concern — it's specifically about the client controlling which headers get stripped from the upstream request via the Connection header, subverting the proxy's `rewriteRequestHeaders` function.\n\n### PoC\n\nSelf-contained reproduction with an upstream echo service and a proxy that adds a custom header:\n\n```javascript\nconst fastify = require('fastify');\n\nasync function test() {\n  // Upstream service that echoes headers\n  const upstream = fastify({ logger: false });\n  upstream.get('/api/echo-headers', async (request) => {\n    return { headers: request.headers };\n  });\n  await upstream.listen({ port: 19801 });\n\n  // Proxy that adds a custom header via rewriteRequestHeaders\n  const proxy = fastify({ logger: false });\n  await proxy.register(require('@fastify/reply-from'), {\n    base: 'http://localhost:19801'\n  });\n\n  proxy.get('/proxy/*', async (request, reply) => {\n    const target = '/' + (request.params['*'] || '');\n    return reply.from(target, {\n      rewriteRequestHeaders: (originalReq, headers) => {\n        return { ...headers, 'x-forwarded-by': 'fastify-proxy' };\n      }\n    });\n  });\n\n  await proxy.listen({ port: 19800 });\n\n  // Baseline: proxy adds x-forwarded-by header\n  const res1 = await proxy.inject({\n    method: 'GET',\n    url: '/proxy/api/echo-headers'\n  });\n  console.log('Baseline response headers from upstream:');\n  const body1 = JSON.parse(res1.body);\n  console.log('  x-forwarded-by:', body1.headers['x-forwarded-by'] || 'NOT PRESENT');\n\n  // Attack: Connection header strips the proxy-added header\n  const res2 = await proxy.inject({\n    method: 'GET',\n    url: '/proxy/api/echo-headers',\n    headers: { 'connection': 'x-forwarded-by' }\n  });\n  console.log('\\nAttack response headers from upstream:');\n  const body2 = JSON.parse(res2.body);\n  console.log('  x-forwarded-by:', body2.headers['x-forwarded-by'] || 'NOT PRESENT (stripped!)');\n\n  await proxy.close();\n  await upstream.close();\n}\ntest();\n```\n\nActual output:\n```\nBaseline response headers from upstream:\n  x-forwarded-by: fastify-proxy\n\nAttack response headers from upstream:\n  x-forwarded-by: NOT PRESENT (stripped!)\n```\n\nThe `x-forwarded-by` header that the proxy explicitly added in `rewriteRequestHeaders` is stripped before reaching the upstream.\n\nMultiple headers can be stripped at once by sending `Connection: x-forwarded-by, x-forwarded-for`.\n\nBoth the undici (default) and HTTP/1.1 transport handlers in `@fastify/reply-from` are affected, as well as `@fastify/http-proxy` which delegates to `@fastify/reply-from`.\n\n### Impact\n\nAttackers can selectively remove any header added by the proxy's `rewriteRequestHeaders` function. This enables several attack scenarios:\n\n1. **Bypass proxy identification**: Strip headers that identify requests as coming through the proxy, potentially bypassing upstream controls that differentiate between direct and proxied requests\n2. **Circumvent access control**: If the proxy adds headers used for routing, authorization, or security decisions (e.g., `x-internal-auth`, `x-proxy-token`), attackers can strip them to access unauthorized resources\n3. **Remove arbitrary headers**: Any header can be targeted, including `Connection: authorization` to strip authentication or `Connection: x-forwarded-for, x-forwarded-by` to remove multiple headers at once\n\nThis vulnerability affects deployments where the proxy adds security-relevant headers that downstream services rely on for access control decisions. It undermines the security model where proxies act as trusted intermediaries adding authentication or routing signals.\n\n### Affected Versions\n\n- `@fastify/reply-from` — All versions, both undici (default) and HTTP/1.1 transport handlers\n- `@fastify/http-proxy` — All versions (delegates to `@fastify/reply-from`)\n- Any configuration using `rewriteRequestHeaders` to add headers that could be security-relevant\n- No special configuration required to exploit — works with default settings\n\n### Suggested Fix\n\nThe Connection header from the client should be processed and consumed before `rewriteRequestHeaders` is called, not after. Alternatively, the Connection header processing in `request.js` should maintain a list of headers that existed in the original client request and only strip those, not headers added by `rewriteRequestHeaders`.","state":0,"publishedAt":"2026-04-16T01:02:59+00:00","modifiedAt":"2026-09-10T03:51:01.7958686+00:00","affected":[{"ecosystem":"npm","name":"@fastify/reply-from","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"12.6.2"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@fastify/http-proxy","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"11.4.4"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N","score":null,"severity":null},{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:L/SI:H/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/fastify/fastify-reply-from/security/advisories/GHSA-gwhp-pf74-vj37","https://nvd.nist.gov/vuln/detail/CVE-2026-33805","https://cna.openjsf.org/security-advisories.html","https://github.com/fastify/fastify-reply-from"],"sourceUrl":"https://github.com/advisories/GHSA-gwhp-pf74-vj37","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-gwhp-pf74-vj37","identifiers":["GHSA-gwhp-pf74-vj37","CVE-2026-33805"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-01T13:57:21.0120005+00:00","complete":true,"records":1766,"lastAttemptAt":"2026-11-01T13:57:21.0120005+00:00","lastSuccessAt":"2026-11-01T13:57:21.1632398+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:21.1632407+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-aece262bb10a694367a43c24d730aa8e8dc171723eaec4c15cdd32f04bda103f-50400654721c20d1e62d5e20161fa1011500efbfa4660bff21fbf42ab394284d","complete":true,"records":417651,"lastAttemptAt":"2026-11-01T13:57:20.4803086+00:00","lastSuccessAt":"2026-11-01T13:57:20.4526709+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.4803086+00:00","snapshotPublishedAt":"2026-11-01T13:22:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-16dea3261a6142e0a956a04888eec4c6","complete":false,"records":13568,"lastAttemptAt":"2026-11-01T14:09:22.4460439+00:00","lastSuccessAt":"2026-11-01T14:09:22.442+00:00","error":null,"lastVerifiedAt":"2026-11-01T14:09:22.442+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13443,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-01T13:57:21.0120005+00:00","complete":true,"records":1095,"lastAttemptAt":"2026-11-01T13:57:21.0120005+00:00","lastSuccessAt":"2026-11-01T13:57:21.1641254+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:21.1641257+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-40f3d0cdd04e4088bac6e8bb2fe516b0","complete":true,"records":13580,"lastAttemptAt":"2026-11-01T13:57:34.3841835+00:00","lastSuccessAt":"2026-11-01T13:57:34.38+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:34.38+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13637,"expectedIdentifiers":13637,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-21dcd6662970dfea02e4ea60ee637115e8d92664947484d2b9276b3f6568a84f","complete":true,"records":9815,"lastAttemptAt":"2026-11-01T13:57:20.8674133+00:00","lastSuccessAt":"2026-10-30T23:47:34.1817587+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.8674133+00:00","snapshotPublishedAt":"2026-10-30T23:33:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-2de9ccc5290f060c7aa63f89c25dd76f655a64ba1aba7c05c97fa3bee4f09899","complete":true,"records":1967,"lastAttemptAt":"2026-11-01T13:57:20.6544139+00:00","lastSuccessAt":"2026-10-28T20:55:34.2982937+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.6544139+00:00","snapshotPublishedAt":"2026-10-28T20:03:08+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f95f76cd406ae5bae3de632ad37fd2d5160b44f5e6b51748ac6f8f0c0c88e72b","complete":true,"records":3028,"lastAttemptAt":"2026-11-01T13:57:20.9796516+00:00","lastSuccessAt":"2026-10-30T23:47:38.4914494+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.9796516+00:00","snapshotPublishedAt":"2026-10-30T23:18:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-55acacd40a7aab88cf530cfddf98233a5d800cfc6bb1883653ecf5bee50f4426","complete":true,"records":230996,"lastAttemptAt":"2026-11-01T13:57:20.7638808+00:00","lastSuccessAt":"2026-11-01T09:06:49.6961926+00:00","error":null,"lastVerifiedAt":"2026-11-01T13:57:20.7638808+00:00","snapshotPublishedAt":"2026-11-01T08:33:39+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}