diff --git a/vulndb/internal/audit/detect.go b/vulndb/internal/audit/detect.go
index 3861792..5c37973 100644
--- a/vulndb/internal/audit/detect.go
+++ b/vulndb/internal/audit/detect.go
@@ -155,9 +155,10 @@
 func (mv ModuleVulnerabilities) VulnsForPackage(importPath string) []*osv.Entry {
 	var mostSpecificMod *modVulns
 	for _, mod := range mv {
-		if strings.HasPrefix(importPath, mod.mod.Path) {
-			if mostSpecificMod == nil || len(mostSpecificMod.mod.Path) < len(mod.mod.Path) {
-				mostSpecificMod = &mod
+		md := mod
+		if strings.HasPrefix(importPath, md.mod.Path) {
+			if mostSpecificMod == nil || len(mostSpecificMod.mod.Path) < len(md.mod.Path) {
+				mostSpecificMod = &md
 			}
 		}
 	}
diff --git a/vulndb/internal/audit/detect_test.go b/vulndb/internal/audit/detect_test.go
index b9a5ac6..43db9dc 100644
--- a/vulndb/internal/audit/detect_test.go
+++ b/vulndb/internal/audit/detect_test.go
@@ -110,6 +110,15 @@
 				{ID: "b", Package: osv.Package{Name: "example.mod/a/b/c"}},
 			},
 		},
+		{
+			mod: &packages.Module{
+				Path:    "example.mod/d",
+				Version: "v0.0.1",
+			},
+			vulns: []*osv.Entry{
+				{ID: "d", Package: osv.Package{Name: "example.mod/d"}},
+			},
+		},
 	}
 
 	filtered := mv.VulnsForPackage("example.mod/a/b/c")