Advisory
Problem
The GitHub advisory UI correctly shows bounded affected ranges for the 15.x canary entries (e.g., >= 15.3.0-canary.0, < 15.3.0), but the OSV export at https://api.osv.dev/v1/vulns/GHSA-5f7q-jpqc-wp7h is missing fixed events for all 15.x canary ranges except 15.6.0-canary.
For example, the 15.5.1-canary range in the OSV JSON:
{
"ranges": [{"type": "SEMVER", "events": [{"introduced": "15.5.1-canary.0"}]}],
"database_specific": {
"last_known_affected_version_range": "< 15.5.1"
}
}The expected output should be:
{
"ranges": [{"type": "SEMVER", "events": [{"introduced": "15.5.1-canary.0"}, {"fixed": "15.5.1"}]}]
}Per the OSV spec, a range with only an introduced event and no fixed event means all versions from introduced onward are affected. This causes tools like osv-scanner to flag versions like 16.2.1 as vulnerable, since 16.2.1 >= 15.5.1-canary.0 is true and there's no upper bound.
The last_known_affected_version_range field in database_specific is not part of the formal range specification and is not evaluated by osv-scanner.
Affected entries
All 15.x canary entries are affected (14 of 16 total entries). Only the 16.x range and 15.6.0-canary range have proper fixed events. It appears the "Patched versions" field in the advisory is empty for these entries, which causes the export to omit the fixed event.
Impact
osv-scanner (used by GitHub code scanning) produces false positive alerts for next@16.2.1 and likely any other stable Next.js version above 15.0.0-canary.0.
Advisory
Problem
The GitHub advisory UI correctly shows bounded affected ranges for the
15.xcanary entries (e.g.,>= 15.3.0-canary.0, < 15.3.0), but the OSV export athttps://api.osv.dev/v1/vulns/GHSA-5f7q-jpqc-wp7his missingfixedevents for all15.xcanary ranges except15.6.0-canary.For example, the
15.5.1-canaryrange in the OSV JSON:{ "ranges": [{"type": "SEMVER", "events": [{"introduced": "15.5.1-canary.0"}]}], "database_specific": { "last_known_affected_version_range": "< 15.5.1" } }The expected output should be:
{ "ranges": [{"type": "SEMVER", "events": [{"introduced": "15.5.1-canary.0"}, {"fixed": "15.5.1"}]}] }Per the OSV spec, a range with only an
introducedevent and nofixedevent means all versions fromintroducedonward are affected. This causes tools like osv-scanner to flag versions like16.2.1as vulnerable, since16.2.1 >= 15.5.1-canary.0is true and there's no upper bound.The
last_known_affected_version_rangefield indatabase_specificis not part of the formal range specification and is not evaluated by osv-scanner.Affected entries
All
15.xcanary entries are affected (14 of 16 total entries). Only the16.xrange and15.6.0-canaryrange have properfixedevents. It appears the "Patched versions" field in the advisory is empty for these entries, which causes the export to omit thefixedevent.Impact
osv-scanner (used by GitHub code scanning) produces false positive alerts for
next@16.2.1and likely any other stable Next.js version above15.0.0-canary.0.