Get Nix Stats

Retrieve counts of open nixpkgs security issues: the same figures /api/v1/stats publishes under nix, on their own.

Data Source

This endpoint returns statistics only for nixpkgs security issues. For combined stats across all ecosystems, use the /api/v1/stats endpoint.

Endpoint

GET /api/v1/nix/stats

The path is under /nix/, not /api/v1/nix-stats, which has never answered.

Response

{
  "success": true,
  "data": {
    "total": 681,
    "closed": 5179,
    "totalTracked": 5860,
    "bySeverity": {
      "critical": 49,
      "high": 260,
      "medium": 241,
      "low": 51,
      "unknown": 80
    },
    "withFix": 129,
    "assigned": 0
  },
  "timestamp": "2026-09-28T01:02:23.793Z"
}

Response Fields

Field	Type	Description
total	number	Open nixpkgs security issues only, never the whole corpus including closed ones.
closed	number	Closed issues
totalTracked	number	Open and closed together
bySeverity	object	Open issues by severity, enriched from NVD where a CVSS score exists
bySeverity.critical, high, medium, low, unknown	number	Count per severity
withFix	number	Open issues with a known fixed version
assigned	number	Open issues assigned to a contributor on GitHub

A GitHub failure answers 502 with data: null rather than zeros: a list that could not be read is not one with nothing open.

Example

curl https://api.vulnpatch.dev/api/v1/nix/stats

Code Examples

JavaScript

async function displayNixStats() {
  const response = await fetch('https://api.vulnpatch.dev/api/v1/nix/stats');
  const { data } = await response.json();

  console.log(`Open: ${data.total} of ${data.totalTracked} tracked`);
  console.log(`With fix: ${data.withFix}`);
  console.log(`Assigned: ${data.assigned}`);
}

Python

import requests

response = requests.get('https://api.vulnpatch.dev/api/v1/nix/stats')
stats = response.json()['data']

print(f"Open: {stats['total']} of {stats['totalTracked']} tracked")
print(f"With fix: {stats['withFix']}")
print(f"Assigned: {stats['assigned']}")

Related Endpoints

• Nix CVEs - the issues themselves as CVE records
• Aggregate Stats - these figures alongside OSV and recent-advisory counts