      "it should not update": function (res) {
        assert.equal(res.polluted, undefined);
      },
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.