Vulnpatch Docs

Appearance

Get Nix CVEs ​

Retrieve the open nixpkgs security issues as CVE records, each with the nixpkgs attribute it names, the maintainers, the linked pull requests and whether one of them has merged.

Data Source

This endpoint returns CVEs only from nixpkgs security issues on GitHub. For combined stats across all ecosystems, use the /api/v1/stats endpoint.

Endpoint ​

GET /api/v1/nix/cves

The path is under /nix/, not /api/v1/nix-cves, which has never answered.

Response ​

data is the array itself; the counts sit beside it under stats.

json
{
  "success": true,
  "count": 100,
  "data": [
    {
      "nixpkgsId": "NIXPKGS-2026-2780",
      "cveId": "CVE-2026-100505",
      "cveIds": ["CVE-2026-100505"],
      "status": "open",
      "summary": "Ghidra 11.2 through 12.1.4 Heap Out-of-Bounds Read via StringManager",
      "affectedPackages": ["Ghidra"],
      "nixpkgsAttribute": "pkgs.Ghidra",
      "currentVersion": "11.2",
      "fixedVersion": "",
      "severity": "medium",
      "cvssScore": 4.4,
      "publishedAt": "2026-09-27T21:21:37Z",
      "updatedAt": "2026-09-27T21:21:37Z",
      "maintainers": ["vringar", "tbaldwin-dev", "roblabla", "ck3d", "Mic92"],
      "assignees": [],
      "githubIssue": "https://github.com/NixOS/nixpkgs/issues/567656",
      "githubIssueNumber": 567656,
      "linkedPRs": [],
      "hasPR": false,
      "hasOpenPR": false,
      "hasMergedPR": false,
      "trackerUrl": "https://tracker.security.nixos.org/issues/NIXPKGS-2026-2780",
      "nvdUrl": "https://nvd.nist.gov/vuln/detail/CVE-2026-100505"
    }
  ],
  "stats": {
    "total": 100,
    "byPackage": { "Ghidra": 1, "suricata": 2 },
    "bySeverity": { "critical": 10, "high": 50, "medium": 32, "low": 7, "unknown": 1 },
    "withPR": 12,
    "withFix": 32,
    "assigned": 2
  },
  "source": "github",
  "population": "open issues filed by the security tracker app, newest first",
  "partial": true,
  "pageSize": 100,
  "complete": false,
  "timestamp": "2026-09-28T01:02:44.801Z"
}

This is one page of the newest open issues the tracker app filed, not the open population: count and stats.total both read 100 even when far more are open. population, partial, pageSize and complete say so explicitly so a reader cannot mistake this page for the full open set. /api/v1/issues carries every labelled issue, open and closed.

Response Fields ​

FieldTypeDescription
countnumberRecords in data
data[].nixpkgsIdstringThe NixOS security review's own id for the issue; empty string when it filed none, never null
data[].cveIdstringThe primary CVE identifier
data[].cveIdsstring[]Every CVE the issue names
data[].statusstringAlways open -- this route's underlying fetch only ever queries open issues, so closed cannot appear here
data[].summarystringThe issue title, or the CVE summary
data[].affectedPackagesstring[]Package names as the issue states them
data[].nixpkgsAttributestringThe nixpkgs attribute the issue body names; empty string when none is named
data[].packageGuessstring|nullA package name read from the issue title, only when no attribute was found in the body. A guess, not a confirmed attribute -- never carries a pkgs. prefix
data[].currentVersionstringThe version the issue reports as affected
data[].fixedVersionstringThe version that fixes it; empty when unknown
data[].severitystringcritical, high, medium, low or unknown
data[].cvssScorenumberPresent when the severity was enriched from NVD
data[].publishedAt, updatedAtstringISO 8601 timestamps of the issue
data[].maintainersstring[]The nixpkgs maintainers of the attribute
data[].assigneesstring[]GitHub usernames assigned to the issue
data[].githubIssue, githubIssueNumberstring, numberThe issue
data[].linkedPRsarrayPull requests linked to the issue: number, title, state, url
data[].hasPR, hasOpenPR, hasMergedPRbooleanWhether any linked pull request exists, is open or has merged
data[].trackerUrlstringThe issue on the NixOS security review site; empty string when nixpkgsId is empty, never null
data[].nvdUrlstringThe CVE on NVD
stats.totalnumberCount of issues on this page only -- not the open population, see population/complete above
populationstringWhat this endpoint's data actually is: one page of open issues filed by the tracker app
partialbooleanAlways true -- this is never the full open set
pageSizenumberIssues held per page (100)
completebooleanAlways false for this endpoint
stats.byPackageobjectCount per package name
stats.bySeverityobjectCount per severity
stats.withPR, withFix, assignednumberIssues with a linked PR, a known fixed version, an assignee
sourcestringWhere the list came from on this request

Example ​

bash
curl https://api.vulnpatch.dev/api/v1/nix/cves

Code Examples ​

javascript
async function getNixCVEs() {
  const response = await fetch('https://api.vulnpatch.dev/api/v1/nix/cves');
  const { data, stats } = await response.json();

  const withOpenPRs = data.filter(cve => cve.hasOpenPR);
  console.log(`${stats.total} open, ${withOpenPRs.length} with an open PR`);

  for (const cve of withOpenPRs) {
    console.log(`${cve.cveId}: ${cve.linkedPRs.length} PRs`);
  }
}
python
import requests

body = requests.get('https://api.vulnpatch.dev/api/v1/nix/cves').json()

# Unassigned issues with a known fixed version
unassigned_fixable = [
    cve for cve in body['data']
    if cve['fixedVersion'] and not cve['assignees']
]

print(f"Unassigned with a known fix: {len(unassigned_fixable)}")
for cve in unassigned_fixable[:5]:
    print(f"  {cve['cveId']} -> {cve['fixedVersion']}")

Caching ​

Answers are cached for an hour; the X-Cache header says whether you received a cached one. A GitHub failure answers 500 with success: false rather than an empty list.