NVD's Processing Backlog and the Vulnerability Intelligence Crisis: What Organizations Should Do

What Happened to NVD

NVD's processing backlog emerged from a combination of factors: a significant surge in CVE volume (the CVE numbering authority program expanded dramatically, increasing the number of CVEs requiring analysis), a shift in the interoperability and support contract that had previously been processing CVEs, and staffing challenges at NIST's cybersecurity division. By May 2024, NIST acknowledged the backlog publicly and announced a consortium of CVE Numbering Authorities (CNAs) and the cybersecurity community would take over enrichment responsibilities for the backlogged CVEs.

Impact on SBOM and SCA Programs

Organizations whose SCA tools relied primarily on NVD data experienced a period where newly disclosed CVEs appeared in their SBOMs without severity information — making prioritization impossible. CVEs without CVSS scores are difficult to triage: you know a vulnerability exists, but you cannot automatically classify it as critical, high, medium, or low. This undermined automated vulnerability management workflows that used CVSS severity as the primary prioritization signal.

The Multi-Database Response

The industry response to NVD's backlog accelerated adoption of alternative and complementary vulnerability intelligence sources. OSV (Open Source Vulnerabilities), maintained by Google, provides fast, high-quality vulnerability data for open source packages with excellent PURL-based matching. GitHub Advisory Database (GHSA) covers the npm, Maven, PyPI, and other ecosystems with timely enrichment. EPSS (Exploit Prediction Scoring System) provides exploitation probability data that does not depend on NVD processing. Organizations that had invested in multi-database vulnerability intelligence before the NVD crisis were significantly less impacted.

The Architecture Going Forward

The NVD crisis revealed the fragility of single-source vulnerability intelligence. Best practice now is to consume vulnerability data from multiple authoritative sources — NVD, OSV, GHSA, and ecosystem-specific databases — through a unified intelligence layer that deduplicates, enriches, and prioritizes findings. SCA platforms that aggregate across databases provide better coverage and resilience than those that depend on NVD alone.