Data quality: Next.js CVEs only reference Git repo — missing npm package (next) ecosystem entries

[fingeromer]

Hi OSV team — reporting a data quality / ecosystem modeling issue affecting multiple Next.js CVEs.

For the following CVEs, the OSV records list only a Git repository
(Git / github.com/vercel/next.js) as the affected package, without an npm
ecosystem entry for the next package from the npm registry:

Affected CVEs:

• CVE-2025-67779
• CVE-2025-55184
• CVE-2025-55183
• CVE-2025-55182

Example:
On the OSV pages, the “Affected packages” section shows only:

• Type: Git
• Repo: https://github.com/vercel/next.js

and the “Affected versions” are expressed as Git tags (e.g., v15.*),
rather than as an npm ecosystem package such as:

• Ecosystem: npm
• Package name: next

Impact:
Most downstream vulnerability consumers (SCA tools, dependency scanners,
package managers) resolve Next.js via the npm registry (next package),
not directly via the Git repository. As a result, vulnerabilities may not
be correctly matched to real-world dependencies when only a Git package
is present in OSV.

Request:
For the CVEs listed above, please add affected package entries for:

• Ecosystem: npm
• Package: next

This would significantly improve accuracy for npm-based dependency
resolution and vulnerability detection.

Thanks for your work on OSV, and happy to provide additional details if
needed.

[jess-lowe]

Hi @fingeromer, thanks for your interest in OSV's data quality.

CVE records we convert are only based on data from NVD and the CVEList, and there is currently no way of programmatically determining the registry package from only CVE records at scale. npm registry information for those vulnerabilities are supplied through their GHSA aliases and would be flagged as such. If the information is missing from the GHSA records, please contact them.

We don't currently have the team or infrastructure for accepting or conducting manual changes to records, so the best solution is to fix the data in upstream data sources.

[fingeromer]

Thank you! so I understand the required mitigation is to open a change request to GHSA, will do!