We use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on repository advisory on 25th Aug, was completely missed by our scanners. Even our socket.dev scans returned nothing related to vulnerability
The advisory exists through GitHub’s repository-advisory API:
- GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vxw4
- HTTP 200
- state: "published"
- severity: "critical"
- published_at: "2026-08-25T16:16:28Z"
but it's completely missing from the public DB's our scanners rely on:
There's already a blog published by Vercel about this, which is seriously concerning because some developers might not know about it until it's too late.
Is this delay expected? If so, how is everyone covering this gap in the scanning pipeline?
We use Grype for container vulnerability scanning, but the recent `GHSA-2xp9-vwfh-vxw4` (CVSS 9.5 rating) vulnerability, which was initially reported on repository advisory on 25th Aug, was completely missed by our scanners. Even our socket.dev scans returned nothing related to vulnerability
The advisory exists through GitHub’s repository-advisory API:
- GET /repos/vercel/next.js/security-advisories/GHSA-2xp9-vwfh-vxw4
- HTTP 200
- state: "published"
- severity: "critical"
- published_at: "2026-08-25T16:16:28Z"
but it's completely missing from the public DB's our scanners rely on:
- https://api.github.com/advisories/GHSA-2xp9-vwfh-vxw4 - HTTP 404
- https://api.osv.dev/v1/vulns/GHSA-2xp9-vwfh-vxw4 - HTTP 404
There's already a blog published by Vercel about this, which is seriously concerning because some developers might not know about it until it's too late.
Is this delay expected? If so, how is everyone covering this gap in the scanning pipeline?