jackwener/OpenCLI · warning · EmptyResultError

nvd cve

nvd cve

Error message

NVD has no record for "${id}".

What it means

An EmptyResultError with code "nvd cve" thrown when NVD's response parsed fine but contains no vulnerability record for the requested id — body.vulnerabilities is empty or list[0].cve.id is missing. The library treats this as a definitive "NVD has no record" answer rather than a failure of transport.

Source

Thrown at clis/nvd/cve.js:103

            throw new CommandExecutionError(
                'nvd cve returned HTTP 429 (rate limited)',
                'NVD throttles unauthenticated traffic; wait several seconds before retry.',
            );
        }
        if (!resp.ok) {
            throw new CommandExecutionError(`nvd cve returned HTTP ${resp.status}`);
        }
        let body;
        try {
            body = await resp.json();
        }
        catch (err) {
            throw new CommandExecutionError(`nvd cve returned malformed JSON: ${err?.message ?? err}`);
        }
        const list = Array.isArray(body?.vulnerabilities) ? body.vulnerabilities : [];
        const cve = list[0]?.cve;
        if (!cve || !cve.id) {
            throw new EmptyResultError('nvd cve', `NVD has no record for "${id}".`);
        }
        const cvss = pickPrimaryCvss(cve.metrics);
        const cvssData = cvss?.cvssData ?? {};
        return [{
            id: String(cve.id),
            published: String(cve.published ?? '').slice(0, 10),
            lastModified: String(cve.lastModified ?? '').slice(0, 10),
            vulnStatus: String(cve.vulnStatus ?? ''),
            baseScore: cvssData.baseScore != null ? Number(cvssData.baseScore) : null,
            severity: String(cvssData.baseSeverity ?? cvss?.baseSeverity ?? ''),
            attackVector: String(cvssData.attackVector ?? ''),
            cwe: joinCwes(cve.weaknesses),
            kevAdded: cve.cisaExploitAdd ? String(cve.cisaExploitAdd).slice(0, 10) : '',
            description: pickEnglishDescription(cve.descriptions),
            url: `https://nvd.nist.gov/vuln/detail/${cve.id}`,
        }];
    },
});

View on GitHub (pinned to 49907e53dc)

Solutions

  1. Double-check the CVE id against the source (advisory, changelog, vendor bulletin).
  2. Verify on cve.org / cve.mitre.org whether the id is real, reserved, or rejected.
  3. If the CVE was published very recently, retry later — NVD enrichment lags publication.
  4. Use NVD keyword search instead of cveId lookup when unsure of the exact id.

Example fix

// before
nvd cve "CVE-2021-4428"
// after (correct digits)
nvd cve "CVE-2021-44228"
Defensive patterns

Strategy: fallback

Validate before calling

// sanity check id before calling
if (!/^CVE-\d{4}-\d{4,}$/.test(id)) throw new Error('bad id');

Type guard

const isPlausibleCveId = (v) => /^CVE-\d{4}-\d{4,}$/i.test(String(v));

Try / catch

try { return await nvdCve(id); } catch (e) { if (e.code === 'nvd cve' && /no record/.test(e.message)) return lookupElsewhere(id); throw e; }

Prevention

When it happens

Trigger: Querying a syntactically valid but non-existent CVE id (e.g. CVE-2099-00001), a rejected/withdrawn CVE not in the CVE list, or an id with an impossible sequence number that NVD never assigned.

Common situations: Typos in a CVE id copied from a report, fabricating ids from ticket numbers, querying CVEs reserved but never published, or NVD ingest lag for very recently published CVEs.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/6ee3b92bb90aab30. Report an issue: GitHub.