6/12/2025 NOTE: the Test environment of CVE Services now includes the release candidate “User Registry” which adds many additional features. See the details at the end of this ReadMe doc.

CVE-API

!CodeQL

Table of contents

• Project
• Contributing

• Development

The CVE Services Project

This repository contains services that support the CVE Program's mission to "identify, define, and catalog publicly disclosed cybersecurity vulnerabilities."

There are many ways one can assist:

OSS Contributor

Developers can contribute code directly. Getting started can be as fast as choosing an issue on our board.

Please read our contributor's guide for more details. We welcome all contributions!

Working Groups

The CVE project operates as multiple focused working groups. Visit the CVE Website working groups page for more information.

Security

Reporting a Vulnerability

Warning

Do not put vulnerability information in a GitHub issue.

Please consult our SECURITY.md for specific instructions on reporting a vulnerability that exists in the CVE Services.

Development

Technologies

This project uses or depends on software from

• NodeJS
• Express
• MongoDB for locally run instances
• Mongoose.js

Style Guidelines

This project follows the JavaScript Standard Style.

Setup

Docker

See the Docker README found in the repo here: https://github.com/CVEProject/cve-services/blob/dev/docker/README.md

Local Development

Warning

>DO NOT use the dev configuration on a public network. The dev environment includes credentials to enable rapid development and is not secure for public deployment.

1. Install required node modules

cd cve-services
npm install

1. Setup and start MongoDB locally

• https://docs.mongodb.com/manual/administration/install-community/

• https://www.mongodb.com/download-center/compass

You can reset the local development database, run pending database migrations, and populate Cve, Cve-Id-Range, Cve-Id, Org, BaseOrg, User, BaseUser, and Glossary seed data using:

npm run populate:dev

To populate without automatically applying versioned migrations, use the following command, then run the migrations manually when ready:

npm run populate:dev -- --skip-migrations
npm run db:migrate:dev

If the database only needs versioned data migrations without a local data reset, check the migration status and then apply pending migrations:

npm run db:migrate:status
npm run db:migrate:dev

Migrations are managed by migrate-mongo using migrate-mongo-config.js. The applied migration records are stored in the migrations_changelog collection. Existing migrate:* scripts are legacy data sync scripts and are separate from these versioned database migrations.

1. Start the node application

npm run start:dev

API Documentation

API documentation is generated using swagger-autogen which ensures that we keep the API specification up to date with any major changes to API routes. Extra information for each API route is defined as a comment in the index.js files under the respective controller and all request and response schemas are stored under the schemas folder served up by schemas.controller.

To ensure you are using the correct API specification the following endpoints can be used:

• Test Instance
• Production

If you are developer and want to test changes to the API specification you can generate a specification in one of two ways:

1. Preferred

1. Manual

CVE Record Submission Validation Rules

As part of the submission processing, CVE Services "validates" that specific requirements are met prior to accepting the submission and posting the CVE Record to the CVE List. Validation rules for CVE Record Submission are noted here.

Unit Testing

This project uses the following for unit testing

• https://mochajs.org/
• https://www.chaijs.com/

npm run start:test

User Registry

The CVE Automation Working Group (on behalf of the CVE Program) is currently working on a new automation capability: the User Registry. The objective of the User Registry is to modernize how CVE Program Organizations (e.g., CNAs, Roots, Top level Roots, the Secretariat) manage/update their organizational properties and user pools. The new capability will ultimately allow CNAs, Roots, Top Level Roots to better manage their own data/user pools with more robust information. It is targeted to be implemented in a series of incremental deployments to CVE Services in the Fall/2025 through Summer/2026.

Current Status:

The release candidate for the first User Registry increment (termed the User Registry MVP) is now available for testing/review in the CVE Program Testing Environment. (Note that this release IS NOT a PRODUCTION Release and will not be visible in the CVE Program PRODUCTION environment). This release candidate establishes a new, more robust User/Organizations databases (and associated APIs) while maintaining full backwards compatibility with the current User/Organizational management functions (meaning that current CVE Services clients will not be required to be modified with the deployment of this candidate). It was discussed at the 6/10/2025 CVE Program AWG meeting.

HowTo:

Credentialed users of CVE Services Test Environment will be able to use the new capabilities via the API endpoints which are described here (Be sure to scroll down to the bottom of the page to review the new User Registry interfaces).

Credentialed users can access the APIs by

• installing/using common web application API testing tools such as curl or postman OR

• installing/using the User Registry Client which provides a GUI interface to exercise the basic functions of the User Registry.

Next Steps:

The AWG is taking comments/questions on this release candidate. You can provide feedback in three ways:

• Send comments/questions to [email protected],

• Post Issues/Questions to the CVE Services Issue Board (please attach a “user registry” label to your post).

• Attend (virtually) an AWG meeting which meets every week on Tuesday at 4:00 PM Eastern US Time. Send a request for the link to [email protected].