GHSA-28wg-ghj8-5hjv CVE-2026-67214
nanoid: non-secure generators can loop indefinitely with negative size
- Severity
- 8.2 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.33%
- Chance of exploitation in the next 30 days. Higher than 26.15% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
3.3.16- Upgrade nanoid to this version or later
Description
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| nanoid | < 3.3.16 |
3.3.16 |
| nanoid | >= 4.0.0, < 5.1.16 |
5.1.16 |
| nanoid | < 3.3.16 |
3.3.16 |
| nanoid | >= 4.0.0, < 5.1.16 |
5.1.16 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nanoid npm → 3.3.16
- npm
npm install nanoid@3.3.16- yarn
yarn add nanoid@3.3.16- pnpm
pnpm add nanoid@3.3.16
Severity breakdown
CVSS 4.0 8.2
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- High
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xwg4-73v4-xw9w nanoid: Integer Overflow or Wraparound | High | Also affects nanoid |
| GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero | High | Also affects nanoid |
| GHSA-mwcw-c2x4-8c55 Predictable results in nanoid generation when given non-integer values | Medium | Also affects nanoid |
| GHSA-qrpm-p2h7-hrv2 Exposure of Sensitive Information to an Unauthorized Actor in nanoid | Medium | Also affects nanoid |
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, CWE-835 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | Low | Same weakness, CWE-835 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) | Medium | Same weakness, CWE-835 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor