{"api_version":"v1","generated_at":"2026-10-08T08:50:00+00:00","product":{"cve_count":3,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-smallstep-certificates-c63088bc9773","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/certificates","name":"certificates","next_cursor":null,"observations":[{"affected":">= 0.24.0, < 0.30.0-rc3","affected_versions_present":true,"cve_id":"CVE-2026-40097","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-40097","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-04-10T18:30:15.176Z","patch_url":"https://github.com/smallstep/certificates/pull/2569","primary_source":"","published":"2026-04-10T16:34:53.330Z"},{"affected":"< 0.30.0","affected_versions_present":true,"cve_id":"CVE-2026-30836","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-30836","fixed":"0.30.0.","last_modified":"2026-03-25T14:16:09.012Z","patch_url":"https://github.com/smallstep/certificates/commit/e6da031d5125cfd99fe9a26f74bb41e4dacca4ef","primary_source":"","published":"2026-03-19T20:37:05.757Z"},{"affected":"< 0.29.0","affected_versions_present":true,"cve_id":"CVE-2025-66406","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-66406","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-12-03T21:40:59.681Z","patch_url":"","primary_source":"","published":"2025-12-03T19:13:48.240Z"}],"source_generated_at":"2026-10-08T06:18:52.353Z","vendor":"smallstep"}}