OSV (Open Source Vulnerabilities) API

Free Google OSV API with no key: query any package version against a unified vulnerability database spanning npm, PyPI, Go, Maven, crates.io and more. Tested.

No API key requiredHTTPSFree tier

Endpoint tested and returned HTTP 200 on 2026-08-20

What is the OSV (Open Source Vulnerabilities) API?

OSV (Open Source Vulnerabilities) is a free, key-free vulnerability database from Google that lets you query any open source package and version to find known security advisories across every major ecosystem.

OSV solves fragmentation: vulnerability data was previously scattered across GitHub Advisories, PyPA, RustSec, Go's database and others, each with a different schema. OSV aggregates them into one format with one query interface.

The version-aware query is the practical value. Rather than returning every advisory for a package, you pass the exact version you use and get only the vulnerabilities that actually affect it — which is what a dependency scanner needs and what a CVE list alone cannot tell you.

Quick facts

Base URL: https://api.osv.dev/v1
Authentication: No API key required.
Rate limit: No published hard limit; the batch endpoint exists for scanning many packages at once.
Pricing: Free, operated by Google as open infrastructure.
CORS: Not enabled — call it from your server
Official docs: Read the docs

How to use the OSV (Open Source Vulnerabilities) API

Every request below was executed against the live API on 2026-08-20, and the response shown is the real body it returned — not an illustration.

1. Check a package version for vulnerabilities

POST https://api.osv.dev/v1/query

curl

curl -X POST 'https://api.osv.dev/v1/query' \
  -H 'Content-Type: application/json' \
  -d '{"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.15"}'

JavaScript (fetch)

const res = await fetch("https://api.osv.dev/v1/query", {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
  },
  body: JSON.stringify({"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.15"}),
});
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

headers = {
    "Content-Type": "application/json",
}

payload = {"package":{"name":"lodash","ecosystem":"npm"},"version":"4.17.15"}

res = requests.post("https://api.osv.dev/v1/query", headers=headers, json=payload, timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "vulns": [
    {
      "id": "GHSA-29mw-wpgm-hmr9",
      "summary": "Regular Expression Denial of Service (ReDoS) in lodash",
      "details": "All versions of package lodash prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the `toNumber`, `trim` and `trimEnd` functions. \n\nSteps to reproduce (provided by reporter Liyuan Chen):\n```js\nvar lo = require('lodash');\n\nfunction build_blank(n) {\n    var ret = \"1\"\n    for (var i = 0; i < n; i++) {\n        ret += \" \"\n    }\n    return ret + \"1\";\n}\nvar s = build_blank(50000) var time0 = Date.now();\nlo.trim(s) \nvar time_cost0 = Date.now() - time0;\nconsole.log(\"time_cost0: \" + time_cost0);\nvar time1 = Date.now();\nlo.toNumber(s) var time_cost1 = Date.now() - time1;\nconsole.log(\"time_cost1: \" + time_cost1);\nvar time2 = Date.now();\nlo.trimEnd(s);\nvar time_cost2 = Date.now() - time2;\nconsole.log(\"time_cost2: \" + time_cost2);\n```",
      "aliases": [
        "CVE-2020-28500"
      ],
      "modified": "2025-09-29T21:12:31.102523Z",
      "published": "2022-01-06T20:30:46Z",
      "database_specific": {
        "github_reviewed_at": "2021-03-19T22:45:28Z",
        "github_reviewed": true,
        "nvd_published_at": "2021-02-15T11:15:00Z",
        "severity": "MODERATE",
        "cwe_ids": [
          "CWE-1333",
          "CWE-400"
        ]
      },
      "references": [
        {
          "type": "ADVISORY",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28500"
        },
        {
          "type": "WEB",
          "url": "https://github.com/github/adv

2. Fetch a single advisory by its id

GET https://api.osv.dev/v1/vulns/GHSA-jf85-cpcp-j695

curl

curl 'https://api.osv.dev/v1/vulns/GHSA-jf85-cpcp-j695'

JavaScript (fetch)

const res = await fetch("https://api.osv.dev/v1/vulns/GHSA-jf85-cpcp-j695");
if (!res.ok) throw new Error(`Request failed: ${res.status}`);
const data = await res.json();
console.log(data);

Python (requests)

import requests

res = requests.get("https://api.osv.dev/v1/vulns/GHSA-jf85-cpcp-j695", timeout=20)
res.raise_for_status()
print(res.json())

Response — HTTP 200 (truncated)

{
  "id": "GHSA-jf85-cpcp-j695",
  "summary": "Prototype Pollution in lodash",
  "details": "Versions of `lodash` before 4.17.12 are vulnerable to Prototype Pollution.  The function `defaultsDeep` allows a malicious user to modify the prototype of `Object` via `{constructor: {prototype: {...}}}` causing the addition or modification of an existing property that will exist on all objects.\n\n## Recommendation\n\nUpdate to version 4.17.12 or later.",
  "aliases": [
    "CVE-2019-10744"
  ],
  "modified": "2026-03-14T09:41:05.242311Z",
  "published": "2019-07-10T19:45:23Z",
  "database_specific": {
    "github_reviewed_at": "2019-07-10T19:41:11Z",
    "github_reviewed": true,
    "nvd_published_at": "2019-07-26T00:15:00Z",
    "severity": "CRITICAL",
    "cwe_ids": [
      "CWE-1321",
      "CWE-20"
    ]
  },
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10744"
    },
    {
      "type": "WEB",
      "url": "https://github.com/lodash/lodash/pull/4336"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:3024"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20191004-0005"
    },
    {
      "type": "WEB",
      "url": "https://snyk.io/vuln/SNYK-JS-LODASH-450202"
    },
    {
      "type": "WEB",
      "url": "https://support.f5.com/csp/article/K47105354?utm_source=f5support&amp%3Butm_medium=RSS"
    }

Parameters

Parameter	Type	Required	Description
`query`	path	Optional	POST a package and version to find affecting vulnerabilities. `query`
`package.name / package.ecosystem`	body	Optional	Package identity in the POST body. `{"name":"lodash","ecosystem":"npm"}`
`version`	body	Optional	The exact version in use. `4.17.15`
`vulns/<id>`	path	Optional	Fetch one advisory by id. `vulns/GHSA-jf85-cpcp-j695`
`querybatch`	path	Optional	Query many packages in a single request. `querybatch`

Response fields

vulnsarray: Vulnerabilities affecting the queried version. Empty means none known.
vulns[].idstring: Advisory id — GHSA, PYSEC, RUSTSEC or CVE.
vulns[].summarystring: Short description of the vulnerability.
vulns[].detailsstring: Full description in Markdown.
vulns[].affectedarray: Affected version ranges and ecosystems.
vulns[].severityarray: CVSS vectors, where assigned.
vulns[].referencesarray: Links to advisories, patches and discussion.

What you can build with the OSV (Open Source Vulnerabilities) API

Scan a dependency manifest for known vulnerabilities
Gate CI on newly disclosed advisories
Check whether a specific version is affected before upgrading
Build security tooling across multiple package ecosystems

Common errors and how to fix them

Empty vulns array

No known vulnerabilities for that version — the good case.

Fix: Absence means nothing is currently published, not that the package is proven safe.

400 on the query body

Ecosystem names are case-sensitive.

Fix: Use `npm`, `PyPI`, `Go`, `Maven`, `crates.io` exactly as documented.

Slow when scanning many packages

One request per dependency is inefficient.

Fix: Use /querybatch to submit an entire manifest in a single request.

OSV (Open Source Vulnerabilities) API — frequently asked questions

Is the OSV API free?

Yes, completely free with no API key. It is operated by Google as open security infrastructure.

Which ecosystems does it cover?

npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist, Linux distributions and more — aggregating GitHub Advisories, PyPA, RustSec and others into one schema.

How is this better than querying CVEs?

OSV is version-aware. You pass the exact version you use and get only advisories that actually affect it, rather than every CVE ever filed against the package.

How do I scan a whole project?

Use the /querybatch endpoint, which accepts many package/version pairs in one request rather than looping.

Tools that pair with this API

JSON Formatter

Format, beautify and minify JSON online with 2-space, 4-space or tab indentation. Sort keys alphabetically and catch syntax errors instantly — free and private.

JSON Validator

Free online JSON validator: validate JSON and find syntax errors with the exact line and column. See root type, key counts and depth — instant and 100% private.

OSV (Open Source Vulnerabilities) is an independent third-party service and is not affiliated with ByteTools or ByteVancer. Details on this page were verified on 2026-08-20; always check the official documentation before relying on this API in production, as terms and limits can change.