Yes, it is possible. NVD removed its legacy 1.1 vulnerability feeds, the 1.0 CPE Match feed and the CPE 2.3 dictionary files on 20 August 2025. A script or tool that still fetches those files gets nothing useful. Check your downloads, error logs and tool versions, then move to the 2.0 feeds or the API.
What changed and when
NIST's NVD announcements give a clear timeline:
| Date | Event |
|---|---|
| 24 Feb 2025 | NVD announced it would replace the 1.1 vulnerability feeds, 1.0 CPE Match feed and CPE 2.3 dictionary with 2.0-compliant files, with a three-month overlap |
| 19 May 2025 | The 2.0 feed files were published; legacy files stayed available |
| 19 May 2025 | Rate-limited API requests began returning HTTP 429 instead of 403 |
| 20 Aug 2025 | The legacy feed files were removed and are no longer accessible |
| 16 Sep 2025 | API keys are issued through a form rather than shown on page load |
A silent failure is the real danger. A job that downloads a file, gets an error page, and keeps using last month's copy will look healthy while its data ages.
How to check your own setup
- Search your repositories, cron jobs and CI configs for the old file names, such as feed names containing "1.1" or a CPE dictionary download.
- Look at the age of the data your tool uses. Many scanners print a database build date. If it is months old, find out why.
- Read the logs of any updater for HTTP 403 or 404 errors around and after August 2025.
- If you wrote an API client, check how it handles 429. Older code often treated 403 as the rate-limit signal.
- Confirm where your API key came from. Keys requested before the form change still need to be stored properly, as for any credential.
If you use a commercial or open source scanner, ask the vendor which NVD interface it uses and since when. A current tool should say so plainly.
Moving to the supported options
You have two routes. The first is the 2.0 feed files NVD published in May 2025. The second is the API, where syncing by last-modified date range keeps you current without full downloads. NVD notes that people who sync this way receive corrections automatically, which matters because records are corrected after publication. For example, about 4,500 CVSS v4.0 scores were corrected on 28 April 2026.
One more point. NVD is one source among several. Package ecosystems publish their own advisories, and the CVE Program publishes its full list on GitHub. A tool that relied only on a retired NVD file may have had a single point of failure. Our post on how to test whether scanner advisory data is fresh shows a simple way to find out.
What to record
Write down, for each data pipeline: the source, the interface (feed or API), the last successful sync, and who is alerted when the sync fails. This takes ten minutes and is the kind of evidence a customer or auditor asks for.
Where Safeguard fits
Safeguard offers SBOM and dependency scanning with continuous monitoring, so findings update as advisories change. You can try a free scan at gold.safeguard.sh/scan. Whatever tool you use, keep the checks above in your runbook.
Quick check
When were the legacy NVD feeds removed?
On 20 August 2025, according to NIST's NVD announcements.
What replaced the 1.1 feeds?
2.0-compliant feed files, published on 19 May 2025, and the NVD API.
What should a client do on a rate limit?
NVD changed rate-limited responses from 403 to 429 in May 2025, so a client should treat 429 as the signal to slow down and retry.
Sources
- NIST, NVD program page and announcements, fetched 19 October 2026.
Last reviewed: 19 October 2026.
