OWASP Dependency-Check finds libraries with known vulnerabilities (CVEs) in a project. It takes its data from the US National Vulnerability Database (NVD). Fetching it through the NVD API is slow: the first update takes hours, needs an API key and runs into rate limits – and a CI pipeline without a cache starts all over again every time.
That is why we run a public mirror: nvd.epicsoft.one.
Static files instead of an API
Every night a CI job fetches the changes in the NVD with vulnz (open-vulnerability-cli) and publishes the complete data feed as static, compressed JSON files. Clients download them over plain HTTP: no API key, no pagination, no rate limits. Since each run only fetches the changes, it takes a few minutes.
dependency-check --updateonly \
--nvdDatafeed https://nvd.epicsoft.one/nvdcve-{0}.json.gzReady-made databases
Instead of building its database itself, Dependency-Check can also start from a finished one. Every night the mirror loads the new feed into fresh databases – including the CISA catalogue of known exploited vulnerabilities – and publishes them next to the feed:
- H2, the built-in database of Dependency-Check
- MariaDB and MySQL
- PostgreSQL
Each file comes with a SHA-256 checksum; db/db.json lists the Dependency-Check version, the state of the data and the number of entries. The files only fit that version of Dependency-Check.
Built to fail safely
- A run only publishes when every year of the feed is complete and readable; otherwise it stops, and the previous state stays online.
- A database that fails or does not match the others never holds back the feed – the mirror then keeps the databases of the night before.
- The feed files are served unchanged, so clients receive exactly the compressed data they expect.
Free to use
The mirror is free to use. The NVD data and the CISA catalogue are in the public domain; our scripts and the CI configuration are open source under the MIT licence on GitLab and GitHub. Problems are welcome as issues – security problems please as a confidential issue on GitLab.
Dependency checks belong in every pipeline – we will help you set them up.