Q.What is a GitHub security advisory, and how is a GHSA different from a CVE?

TL;DR: We pulled the newest 100 advisories of each type from GitHub's public API on Oct 27 2026. The last 100 reviewed advisories were published in just over 4 days, 77 of them also had a CVE id, and 55 were Python (pip) packages against 22 for npm. The last 100 malware advisories took only 2.2 days, 89 were npm, and none had a CVE.

The CVE system was built for vendors shipping boxed software. Open source moves faster than that, and the GHSA exists because the package world needed its own catalog, mapped to exact package names and version ranges a machine can act on. That mapping is the whole point: it is what lets Dependabot, npm audit and the checker in our OSV guide say "you are affected, upgrade to 10.2.1" instead of "something somewhere is broken."

Key numbers

How to read a GHSA

Take the minimatch advisory from our ReDoS explainer. The API returns these fields in plain JSON:

• ghsa_id: GHSA-3ppc-4f35-3m26. Three blocks of four letters and digits, no year, no ordering.
• cve_id: CVE-2026-26996. The same bug in the CVE list.
• vulnerabilities: package minimatch on npm, vulnerable range >= 10.0.0, < 10.2.1, first patched version 10.2.1. This is the part that makes it actionable.
• severity: high. cwes: CWE-1333, Inefficient Regular Expression Complexity.
• github_reviewed_at and nvd_published_at: when GitHub's team signed off, and when the US National Vulnerability Database caught up, 28.6 hours later.

If you only remember one field, make it the version range. "Upgrade past 10.2.1" is a move you can make in one command.

The three kinds of advisory

GitHub sorts the database into three types, and they behave very differently:

1. Reviewed. Checked by GitHub's curators and mapped to a package and version range. These are the ones Dependabot alerts on. Our sample: 100 in about 4 days.
2. Unreviewed. Imported automatically from the NVD feed with no package mapping. All of the latest 100 had a CVE id and no ecosystem, and they landed in one 19-second batch. They do not trigger Dependabot.
3. Malware. Packages published to steal or damage, mostly typosquats on npm. All 100 in our pull were rated critical, and none had a CVE. If your scanner only reads CVEs, it misses this whole column.

Pulled from api.github.com/advisories with type=reviewed, unreviewed and malware, Oct 27 2026.

GHSA vs CVE vs OSV, side by side

OSV is where these meet. It imports GHSAs and lists the CVE as an alias, so one query by package and version gets you all of them. That is what our OSV guide does, and for Rust, cargo audit reads the RustSec database, which also flows into OSV.

Python dominated this particular 4-day window; the mix shifts week to week. Same API pull.

Common misconceptions

What to do now

Turn on Dependabot alerts for every repo (Settings, then Code security), and run one OSV query against your lockfile with the steps in our guide. For the bigger picture on how many npm downloads still sit on vulnerable versions, read our npm advisories breakdown. If you want the Rust crates you depend on re-checked every time a new advisory lands, that is the job Crate Portfolio does.

FAQ

What is a GitHub security advisory?

It is a record in the GitHub Advisory Database describing a vulnerability or malware in an open source package: the package, the affected version range, the first patched version, severity, CWE weakness ids and references. Each one gets an id like GHSA-3ppc-4f35-3m26.

What is the difference between a GHSA and a CVE?

A CVE id is assigned by MITRE or a CVE Numbering Authority and covers any software. A GHSA id is assigned by GitHub and covers packages in the ecosystems GitHub tracks. Many advisories have both: GHSA-3ppc-4f35-3m26 is the same minimatch bug as CVE-2026-26996. Malware advisories usually have no CVE at all.

What does reviewed vs unreviewed mean in the GitHub Advisory Database?

Reviewed advisories have been checked by GitHub's curation team and mapped to a package and version range, so Dependabot can alert on them. Unreviewed advisories are imported automatically from the National Vulnerability Database without a package mapping, so they do not trigger Dependabot alerts.

Is GitHub a CVE Numbering Authority?

Yes. GitHub is a CNA, so when a maintainer publishes a repository security advisory, GitHub can request a CVE id for it. That is why many GHSAs and CVEs appear within a day or two of each other.

How do I check if my project is affected by a GHSA?

Enable Dependabot alerts on GitHub, run npm audit or cargo audit locally, or query the free OSV.dev API with your package and version. OSV imports GitHub's advisories, so a GHSA id shows up there as the id or as an alias.

Sources

All checked October 27, 2026.

• GitHub REST API, Global security advisories: the endpoint and the type=reviewed, unreviewed, malware filter we pulled.
• GitHub Docs, About the GitHub Advisory Database: advisory types and Dependabot behavior.
• GitHub Advisory Database, GHSA-3ppc-4f35-3m26 (minimatch, CVE-2026-26996).
• CVE Program, CNA partner list.
• OSV, OSV.dev and the OSV schema.
• Tensorust, npm advisories article.
• Images: cards and charts by Tensorust.