diff --git a/sql/schema.sql b/sql/schema.sql
index 5ab2592..76a1c6e 100644
--- a/sql/schema.sql
+++ b/sql/schema.sql
@@ -14,4 +14,24 @@ CREATE TABLE IF NOT EXISTS cpe_matches (
  criteria TEXT, vulnerable INTEGER, version_start_including TEXT, version_start_excluding TEXT,
  version_end_including TEXT, version_end_excluding TEXT, source TEXT NOT NULL);
 CREATE INDEX IF NOT EXISTS idx_cpe_vuln ON cpe_matches(vulnerability_id);
+CREATE TABLE IF NOT EXISTS cpe_nodes (
+    id TEXT PRIMARY KEY,
+    vulnerability_id TEXT NOT NULL
+        REFERENCES vulnerabilities(id)
+        ON DELETE CASCADE,
+    parent_id TEXT REFERENCES cpe_nodes(id),
+    operator TEXT NOT NULL
+        CHECK (operator IN ('AND', 'OR')),
+    negate INTEGER NOT NULL DEFAULT 0
+        CHECK (negate IN (0, 1)),
+    source TEXT NOT NULL
+);
+
+CREATE INDEX IF NOT EXISTS idx_cpe_nodes_vuln
+ON cpe_nodes(vulnerability_id);
+ALTER TABLE cpe_matches
+ADD COLUMN node_id TEXT REFERENCES cpe_nodes(id);
+
+CREATE INDEX IF NOT EXISTS idx_cpe_matches_node
+ON cpe_matches(node_id);
 -- Conditions expressed as AND, OR and negate are deliberately NOT converted into independent vulnerability assertions.