{"id":"GHSA-wqvq-jvpq-h66f","revision":null,"records":[{"revision":"83469296401647d494b20982b24ebf0c","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-82660","aliases":[],"title":"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess","description":"Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.","state":0,"publishedAt":"2026-08-31T08:46:25.605+00:00","modifiedAt":"2026-08-31T14:39:52.418+00:00","affected":[{"ecosystem":"Vendor product","name":"nodemailer","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"nodemailer\",\n                    \"product\": \"nodemailer\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:npm/nodemailer\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"8.0.9\"\n                        },\n                        {\n                            \"version\": \"8.0.9\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f","https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-82660","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-82660","identifiers":["CVE-2026-82660"]},"retained":false,"historicalAffected":[]},{"revision":"f1b2609868e6497eb4e635f45c05a7cb","observedAt":"2026-11-13T18:01:46.07+00:00","statement":{"source":"euvd","id":"EUVD-2026-68438","aliases":["CVE-2026-82660","GHSA-28mw-fm9r-fxjg"],"title":"Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, …","description":"Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","score":5.3,"severity":null}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f","https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-68438","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Aug 31, 2026, 8:46:25 AM","dateUpdated":"Aug 31, 2026, 2:39:52 PM"},"relatedAdvisories":[],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-68438","identifiers":["EUVD-2026-68438","CVE-2026-82660","GHSA-28mw-fm9r-fxjg"]},"retained":false,"historicalAffected":[]},{"revision":"49c607f35ac5482084e6ba1963aa6625","observedAt":"2026-10-25T16:19:10.271+00:00","statement":{"source":"nvd","id":"CVE-2026-82660","aliases":[],"title":"Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, …","description":"Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls.","state":0,"publishedAt":"2026-08-31T09:17:03.79+00:00","modifiedAt":"2026-09-10T15:48:28.757+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":5.3,"severity":"MEDIUM"},{"system":"CVSS 3.1 · disclosure@vulncheck.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":5.4,"severity":"MEDIUM"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f","https://www.vulncheck.com/advisories/nodemailer-jsontransport-bypasses-disablefileaccess-and-disableurlaccess"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-82660","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Awaiting Analysis","weaknesses":["CWE-862"],"productCriteria":[],"sourceDates":{"published":"2026-08-31T09:17:03.790","lastModified":"2026-09-10T15:48:28.757"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-82660","identifiers":["CVE-2026-82660"]},"retained":false,"historicalAffected":[]},{"revision":"f7da1d7d7149498091155742c5e6a3b9","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"GHSA-wqvq-jvpq-h66f","aliases":["CVE-2026-82660"],"title":"Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess during message normalization","description":"### Summary\n\nNodemailer's `disableFileAccess` and `disableUrlAccess` options are intended to prevent message content and attachments from reading local files or fetching URLs. The normal MIME streaming path enforces those options in `MimeNode._getStream()`. However, `jsonTransport` serializes messages by calling `mail.normalize()`, which resolves `html`, `text`, alternatives, calendar events, and attachments through `shared.resolveContent()` before MIME generation. `shared.resolveContent()` reads local files and fetches HTTP(S) URLs directly, without receiving or checking `disableFileAccess` or `disableUrlAccess`.\n\nAs a result, applications that use `jsonTransport` as a safe serializer or queue payload generator while relying on `disableFileAccess` / `disableUrlAccess` can still be made to read local files into the generated JSON output or make outbound HTTP requests when an attacker controls message content fields such as attachment `path` or `text.href`.\n\nThe same missing-enforcement root cause is also reachable before normal streaming when `attachDataUrls` causes `_convertDataImages()` to call `mail.resolveContent(mail.data, 'html', ...)`; this should be fixed with the same access-control check.\n\n### Details\nSource-to-sink evidence:\n\n- `lib/nodemailer.js:42-45` selects `JSONTransport` when `createTransport({ jsonTransport: true, ... })` is used.\n- `lib/mailer/mail-message.js:34-39` copies transport-level `disableFileAccess` and `disableUrlAccess` options into `mail.data`.\n- `lib/json-transport/index.js:52-76` serializes mail by calling `mail.normalize((err, data) => ...)`.\n- `lib/mailer/mail-message.js:46-135` implements `resolveAll()` and calls `shared.resolveContent(...args, ...)` for `html`, `text`, `watchHtml`, `amp`, `icalEvent`, alternatives, and attachments.\n- `lib/shared/index.js:506-562` implements `resolveContent()`.\n- `lib/shared/index.js:540-541` fetches HTTP(S) content with `nmfetch(content.path || content.href)`.\n- `lib/shared/index.js:549-550` reads local files with `fs.createReadStream(content.path)`.\n- `shared.resolveContent()` does not check `disableFileAccess` or `disableUrlAccess` and does not receive those flags.\n\nControl path showing intended enforcement:\n\n- `lib/mail-composer/index.js:358-359`, `lib/mail-composer/index.js:367-368`, and sibling child-node creation paths pass `disableUrlAccess` and `disableFileAccess` into `MimeNode`.\n- `lib/mime-node/index.js:51-52` stores those flags.\n- `lib/mime-node/index.js:984-995` rejects file paths with `EFILEACCESS` when `disableFileAccess` is set.\n- `lib/mime-node/index.js:998-1009` rejects URLs with `EURLACCESS` when `disableUrlAccess` is set.\n- `test/mail-composer/mail-composer-test.js:1028-1044` includes a normal MIME-streaming test that expects file access to be blocked when `disableFileAccess: true`.\n\nAdditional same-root-cause variant:\n\n- `lib/mailer/index.js:406-434` implements `_convertDataImages()` for `attachDataUrls`.\n- `lib/mailer/index.js:407-410` calls `mail.resolveContent(mail.data, 'html', ...)` when `attachDataUrls` is enabled and `mail.data.html` is present.\n- Because `mail.resolveContent()` delegates to `shared.resolveContent()` at `lib/mailer/mail-message.js:42-44`, an object-form `html: { path: ... }` or `html: { href: ... }` can be resolved before the later MIME streaming enforcement sees the content.\n- This variant requires `attachDataUrls` to be enabled, so the main reportable default/common path is `jsonTransport`; both should be fixed by enforcing access flags inside the pre-resolution helper or passing policy into it.\n\nDefault/common exposure evidence:\n\n- `jsonTransport` is a shipped runtime transport selected by public `createTransport` options.\n- `test/json-transport/json-transport-test.js:9-83` demonstrates that `jsonTransport` intentionally resolves file-backed `html` and attachments into JSON output.\n- `disableFileAccess` and `disableUrlAccess` are documented by code and tests as security controls and are copied from transport options into message data for all transports.\n- The bypass does not require test-only code, external infrastructure, unsupported configuration, or maintainer-only APIs.\n\nFalse-positive screening and negative controls:\n\n- The local PoC used the same `disableFileAccess: true` and `disableUrlAccess: true` transport options for both `jsonTransport` and normal `streamTransport` controls.\n- `jsonTransport` read the temporary local fixture file and embedded the content in JSON despite `disableFileAccess: true`.\n- `streamTransport` with the same attachment and `disableFileAccess: true` rejected with `EFILEACCESS`.\n- `jsonTransport` fetched a local HTTP listener despite `disableUrlAccess: true`.\n- `streamTransport` with the same URL and `disableUrlAccess: true` rejected with `EURLACCESS`.\n- The local URL proof used only `127.0.0.1` and did not contact external infrastructure.\n\nAffected version evidence and uncertainty:\n\n- Confirmed vulnerable: `nodemailer` 8.0.8 at commit `15138a84c543c20aa399218534cdbbfa2ea1ce55`.\n- Git history shows `jsonTransport` has existed since commit `d78b63b` (2017-02-09, \"Added test for json transport\"), and `disableFileAccess` appears in historical setup commit `6218b8d` (2017-01-31), but older versions were not dynamically tested during this audit.\n- Affected range is therefore recorded as unknown beyond the confirmed current version.\n- No patched version was identified in this checkout.\n\nSeverity rationale:\n\n- AV: The vulnerable library path is typically reached through an application-level message submission or rendering/queueing feature.\n- AC: A single message field using `path` or `href` triggers the bypass when `jsonTransport` is used.\n- PR: Conservative assumption that the attacker is a lower-privileged user of an application that accepts partially user-controlled message objects. Some deployments may expose this unauthenticated, but that was not assumed.\n- UI: No user interaction is required after the application accepts the message object.\n- S: The impact remains in the embedding application/library security scope.\n- C: Local file contents can be copied into the generated JSON output when the application later stores, logs, returns, or forwards that JSON.\n- I: The attacker can induce outbound HTTP requests to attacker-chosen or internal URLs from the application host when URL access was intended to be disabled.\n- A: No availability impact was demonstrated; the PoC used bounded local files and a localhost listener only.\n\nFinal self-review:\n\n- Reproduction evidence was generated locally from this checkout using only a temporary file under the OS temp directory and a local `127.0.0.1` HTTP listener.\n- The PoC included positive proof for file read and URL fetch, plus negative controls showing normal `streamTransport` rejects the same inputs with `EFILEACCESS` and `EURLACCESS`.\n- The proof is non-destructive, performs no external network traffic, and deletes its temporary fixture.\n- Reachability, package exposure, policy-enforcement bypass, same-root-cause variant, and false-positive controls were checked as described above.\n- The affected range is not overclaimed; only the current tested version is confirmed vulnerable.\n\n### PoC\n\nFrom a clean checkout of `nodemailer` at commit `15138a84c543c20aa399218534cdbbfa2ea1ce55`, run:\n\n```bash\nnode <<'NODE'\n'use strict';\nconst fs = require('fs');\nconst os = require('os');\nconst path = require('path');\nconst http = require('http');\nconst nodemailer = require('./');\nconst marker = 'NM_JSON_BYPASS_' + Date.now();\nconst fixture = path.join(os.tmpdir(), 'nodemailer-json-bypass-' + process.pid + '.txt');\nfs.writeFileSync(fixture, marker);\nfunction sendMail(transport, data) {\n  return new Promise((resolve, reject) => transport.sendMail(data, (err, info) => err ? reject(err) : resolve(info)));\n}\n(async () => {\n  const jsonTransport = nodemailer.createTransport({ jsonTransport: true, disableFileAccess: true, disableUrlAccess: true });\n  const jsonInfo = await sendMail(jsonTransport, {\n    from: 'sender@example.test',\n    to: 'recipient@example.test',\n    subject: 'json file bypass',\n    text: 'body',\n    attachments: [{ filename: 'secret.txt', path: fixture }]\n  });\n  const jsonMessage = JSON.parse(jsonInfo.message);\n  const decoded = Buffer.from(jsonMessage.attachments[0].content, 'base64').toString('utf8');\n  console.log('JSON_FILE_BYPASS=' + (decoded === marker));\n  console.log('JSON_FILE_CONTENT=' + decoded);\n\n  const streamTransport = nodemailer.createTransport({ streamTransport: true, buffer: true, disableFileAccess: true });\n  try {\n    await sendMail(streamTransport, {\n      from: 'sender@example.test',\n      to: 'recipient@example.test',\n      subject: 'stream control',\n      text: 'body',\n      attachments: [{ filename: 'secret.txt', path: fixture }]\n    });\n    console.log('STREAM_FILE_CONTROL=NO_ERROR');\n  } catch (err) {\n    console.log('STREAM_FILE_CONTROL=' + err.code);\n  }\n\n  const server = http.createServer((req, res) => {\n    console.log('LOCAL_HTTP_REQUEST=' + req.method + ' ' + req.url);\n    res.end('LOCAL_HTTP_MARKER');\n  });\n  await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));\n  const url = 'http://127.0.0.1:' + server.address().port + '/private';\n  const jsonUrlInfo = await sendMail(jsonTransport, {\n    from: 'sender@example.test',\n    to: 'recipient@example.test',\n    subject: 'json url bypass',\n    text: { href: url }\n  });\n  const jsonUrlMessage = JSON.parse(jsonUrlInfo.message);\n  console.log('JSON_URL_BYPASS=' + (jsonUrlMessage.text === 'LOCAL_HTTP_MARKER'));\n  const streamUrlTransport = nodemailer.createTransport({ streamTransport: true, buffer: true, disableUrlAccess: true });\n  try {\n    await sendMail(streamUrlTransport, {\n      from: 'sender@example.test',\n      to: 'recipient@example.test',\n      subject: 'stream url control',\n      text: { href: url }\n    });\n    console.log('STREAM_URL_CONTROL=NO_ERROR');\n  } catch (err) {\n    console.log('STREAM_URL_CONTROL=' + err.code);\n  }\n  server.close();\n  fs.unlinkSync(fixture);\n})().catch(err => { try { fs.unlinkSync(fixture); } catch (E) {} console.error(err && err.stack || err); process.exit(1); });\nNODE\n```\n\nObserved output in this environment:\n\n```text\nJSON_FILE_BYPASS=true\nJSON_FILE_CONTENT=NM_JSON_BYPASS_1779802076150\nSTREAM_FILE_CONTROL=EFILEACCESS\nLOCAL_HTTP_REQUEST=GET /private\nJSON_URL_BYPASS=true\nSTREAM_URL_CONTROL=EURLACCESS\n```\n\nExpected vulnerable output: `JSON_FILE_BYPASS=true`, the printed temporary marker in `JSON_FILE_CONTENT`, a `LOCAL_HTTP_REQUEST=GET /private` line, and `JSON_URL_BYPASS=true`. Expected negative/control output: `STREAM_FILE_CONTROL=EFILEACCESS` and `STREAM_URL_CONTROL=EURLACCESS`, showing the same policy flags work in the normal streaming transport.\n\nCleanup: the PoC removes its temporary fixture file before exiting and closes the local HTTP server.\n\n### Impact\n\nIf an application uses `jsonTransport` to safely serialize or queue partially user-controlled Nodemailer message objects while relying on `disableFileAccess` / `disableUrlAccess`, an attacker can bypass those protections. The file-read variant can copy local file contents into the generated JSON message output. The URL-fetch variant can force outbound HTTP requests from the application host to local or internal services despite URL access being disabled. The impact depends on what message fields the embedding application exposes and where it stores or returns the generated JSON, but the local PoC confirms both protected sink operations are reached.\n\n### Suggested remediation\n\nEnforce `disableFileAccess` and `disableUrlAccess` inside `shared.resolveContent()` or pass an explicit policy object into every pre-resolution call and reject protected `path` / `href` values before opening files or fetching URLs. Apply the same fix to `jsonTransport` normalization and the `attachDataUrls` pre-plugin path. Add regression tests showing `jsonTransport` returns `EFILEACCESS` / `EURLACCESS` for file and URL content when those flags are set, and that `attachDataUrls` cannot resolve object-form `html.path` / `html.href` when the corresponding access flag is disabled.","state":0,"publishedAt":"2026-06-15T17:35:10+00:00","modifiedAt":"2026-09-10T03:50:51.0645178+00:00","affected":[{"ecosystem":"npm","name":"nodemailer","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"8.0.9"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://github.com/nodemailer/nodemailer/security/advisories/GHSA-wqvq-jvpq-h66f","https://github.com/nodemailer/nodemailer"],"sourceUrl":"https://github.com/advisories/GHSA-wqvq-jvpq-h66f","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-wqvq-jvpq-h66f","identifiers":["GHSA-wqvq-jvpq-h66f","CVE-2026-82660"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-15T03:30:51.8285280+00:00","complete":true,"records":1781,"lastAttemptAt":"2026-11-15T03:30:51.828528+00:00","lastSuccessAt":"2026-11-15T03:30:52.0220544+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:52.0220551+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-7de4d7559a5263003f03d9f70577ab06f92ba4178309f26fce53e22a4a959294-64506870a9a1090a8d0c5272d737568ebd51c8becfe1facb058977cac4ac83fa","complete":true,"records":425769,"lastAttemptAt":"2026-11-15T03:30:50.6159515+00:00","lastSuccessAt":"2026-11-15T03:30:50.6052211+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:50.6159515+00:00","snapshotPublishedAt":"2026-11-15T03:29:56+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-e6ab561e8a444365a873763d64375496","complete":false,"records":13821,"lastAttemptAt":"2026-11-15T03:42:24.4547028+00:00","lastSuccessAt":"2026-11-15T03:42:23.433+00:00","error":"7 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T03:42:23.433+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13867,"expectedIdentifiers":13874,"failedIdentifiers":7},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-15T03:30:51.8285280+00:00","complete":true,"records":1125,"lastAttemptAt":"2026-11-15T03:30:51.828528+00:00","lastSuccessAt":"2026-11-15T03:30:52.022937+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:52.0229398+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-b4e16143cf664d0aa856e1009c943b33","complete":false,"records":13833,"lastAttemptAt":"2026-11-15T03:30:58.3499715+00:00","lastSuccessAt":"2026-11-15T02:30:50.077+00:00","error":"14 identifier lookups failed; latest failures include HttpError (HTTP 503). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-15T02:30:50.077+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13860,"expectedIdentifiers":13874,"failedIdentifiers":14},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-64eea06dbd27de8464d5dbce1b78cc794cc59e2d901516ae0d3ea76e624cdae0","complete":true,"records":9955,"lastAttemptAt":"2026-11-15T03:30:51.6093294+00:00","lastSuccessAt":"2026-11-14T13:57:23.1208135+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.6093294+00:00","snapshotPublishedAt":"2026-11-14T13:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-f4424d7d4861b1af1404bd15abcb83f295dcd003412a9340ca99dc8200aa148a","complete":true,"records":2014,"lastAttemptAt":"2026-11-15T03:30:51.2334746+00:00","lastSuccessAt":"2026-11-13T19:57:08.2864435+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.2334746+00:00","snapshotPublishedAt":"2026-11-13T19:33:10+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-012aff9b2fb349d53e2c4bace6ca57956b6f5f9d82c1dc9fdc1c9b3c738f8977","complete":true,"records":3148,"lastAttemptAt":"2026-11-15T03:30:51.6425919+00:00","lastSuccessAt":"2026-11-14T04:57:03.8279646+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.6425919+00:00","snapshotPublishedAt":"2026-11-14T03:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-deb41cb32d3b3d67de7960b1647d789a5218551d33a54a4b027ba315bcba590f","complete":true,"records":232473,"lastAttemptAt":"2026-11-15T03:30:51.414557+00:00","lastSuccessAt":"2026-11-15T01:46:53.6377511+00:00","error":null,"lastVerifiedAt":"2026-11-15T03:30:51.414557+00:00","snapshotPublishedAt":"2026-11-15T00:48:23+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}