{"record":{"id":"da724b269fb44fd0","repo":"jackwener/OpenCLI","slug":"nvd-cve-returned-malformed-json-err-message","errorCode":null,"errorMessage":"nvd cve returned malformed JSON: ${err?.message ?? err}","messagePattern":"nvd cve returned malformed JSON: (.+?)","errorType":"exception","errorClass":"CommandExecutionError","httpStatus":null,"severity":"error","filePath":"clis/nvd/cve.js","lineNumber":98,"sourceCode":"                'nvd cve returned HTTP 403',\n                'NVD enforces aggressive rate limits without an API key. Wait, then retry or set NVD_API_KEY (not yet wired).',\n            );\n        }\n        if (resp.status === 429) {\n            throw new CommandExecutionError(\n                'nvd cve returned HTTP 429 (rate limited)',\n                'NVD throttles unauthenticated traffic; wait several seconds before retry.',\n            );\n        }\n        if (!resp.ok) {\n            throw new CommandExecutionError(`nvd cve returned HTTP ${resp.status}`);\n        }\n        let body;\n        try {\n            body = await resp.json();\n        }\n        catch (err) {\n            throw new CommandExecutionError(`nvd cve returned malformed JSON: ${err?.message ?? err}`);\n        }\n        const list = Array.isArray(body?.vulnerabilities) ? body.vulnerabilities : [];\n        const cve = list[0]?.cve;\n        if (!cve || !cve.id) {\n            throw new EmptyResultError('nvd cve', `NVD has no record for \"${id}\".`);\n        }\n        const cvss = pickPrimaryCvss(cve.metrics);\n        const cvssData = cvss?.cvssData ?? {};\n        return [{\n            id: String(cve.id),\n            published: String(cve.published ?? '').slice(0, 10),\n            lastModified: String(cve.lastModified ?? '').slice(0, 10),\n            vulnStatus: String(cve.vulnStatus ?? ''),\n            baseScore: cvssData.baseScore != null ? Number(cvssData.baseScore) : null,\n            severity: String(cvssData.baseSeverity ?? cvss?.baseSeverity ?? ''),\n            attackVector: String(cvssData.attackVector ?? ''),\n            cwe: joinCwes(cve.weaknesses),\n            kevAdded: cve.cisaExploitAdd ? String(cve.cisaExploitAdd).slice(0, 10) : '',","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/jackwener/OpenCLI/blob/49907e53dc3ade5c223ff0c4c2c2785687cec4e6/clis/nvd/cve.js#L80-L116","documentation":"Thrown when resp.json() fails to parse the NVD response body, wrapped as a CommandExecutionError with the parse error message. This means NVD returned a 2xx response that is not valid JSON — e.g. an HTML error/interstitial page from a proxy or CDN, or a truncated response.","triggerScenarios":"A cveId lookup where the 2xx body is not JSON: captive portals or proxies injecting HTML, NVD returning an empty/HTML maintenance page with 200, or a response body cut off mid-stream.","commonSituations":"Working behind corporate proxies that rewrite responses, hotel/airport Wi-Fi captive portals, TLS-inspecting middleboxes, or NVD instability during high load.","solutions":["Inspect the raw response (curl the same URL) to see what body NVD actually returned.","Bypass or fix the proxy/intercepting middlebox; try from a different network.","Retry — if it was a truncated/intermittent response, a repeat call often succeeds.","Check that no custom NVD_BASE override points at a non-API endpoint."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { return await nvdCve(id); } catch (e) { if (e.message.includes('malformed JSON')) { logRawResponseForDebugging(); throw new Error('NVD returned non-JSON (proxy/portal?)'); } throw e; }","preventionTips":["Detect captive portals / proxy HTML injection before API calls.","Compare a curl of the endpoint with the library's request when debugging.","Prefer TLS-passthrough over TLS-inspecting proxies for API traffic.","Retry once automatically — truncation is often transient."],"tags":["json","parse-error","nvd","proxy"],"backgroundTag":"invalid-json-response","analyzedSha":"49907e53dc3ade5c223ff0c4c2c2785687cec4e6","analyzedAt":"2026-08-29T08:14:47.543Z","schemaVersion":2},"datasetVersion":"2026-08-29T12:17:43.993Z"}