Critical Next.js RCE Still Missing from GitHub Advisory Database and OSV

Critical Next.js RCE Still Missing from GitHub Advisory Database and OSV(api.github.com)

2 points by stacktrace 2 days ago | 2 comments

stacktrace 2 days ago |

We use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on repository advisory on 25th Aug, was completely missed by our scanners. Even our socket.dev scans returned nothing related to vulnerability

The advisory exists through GitHub’s repository-advisory API:

- GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vxw4

- HTTP 200

- state: "published"

- severity: "critical"

- published_at: "2026-08-25T16:16:28Z"

but it's completely missing from the public DB's our scanners rely on:

- https://api.github.com/advisories/GHSA-2xp9-vwfh-vxw4 - HTTP 404

- https://api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4 - HTTP 404

There's already a blog published by Vercel about this, which is seriously concerning because some developers might not know about it until it's too late.

Is this delay expected? If so, how is everyone covering this gap in the scanning pipeline?

feross 3 hours ago | |

Thanks for pointing this out. Socket is building our own vulnerability database to reduce dependence on the increasingly unreliable GHSA database.