GHSA-mwcw-c2x4-8c55 CVE-2024-55565
Predictable results in nanoid generation when given non-integer values
- Severity
- 4.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.66%
- Chance of exploitation in the next 30 days. Higher than 51.79% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')
- Fix
5.0.9- Upgrade nanoid to this version or later
Description
When nanoid is called with a fractional value, there were a number of undesirable effects:
- in browser and non-secure, the code infinite loops on while (size--)
- in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
- if the first call in node is a fractional argument, the initial buffer allocation fails with an error
Version 3.3.8 and 5.0.9 are fixed.
Affected versions
npm
| Package | Vulnerable | Fixed in |
|---|---|---|
| nanoid | >= 4.0.0, < 5.0.9 |
5.0.9 |
| nanoid | < 3.3.8 |
3.3.8 |
| nanoid | >= 4.0.0, < 5.0.9 |
5.0.9 |
| nanoid | < 3.3.8 |
3.3.8 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
nanoid npm → 5.0.9
- npm
npm install nanoid@5.0.9- yarn
yarn add nanoid@5.0.9- pnpm
pnpm add nanoid@5.0.9
Severity breakdown
CVSS 3.1 4.3
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xwg4-73v4-xw9w nanoid: Integer Overflow or Wraparound | High | Also affects nanoid |
| GHSA-28wg-ghj8-5hjv nanoid: non-secure generators can loop indefinitely with negative size | High | Also affects nanoid |
| GHSA-2v37-7h3g-55p8 nanoid: custom generators can loop indefinitely when size is zero | High | Also affects nanoid |
| GHSA-qrpm-p2h7-hrv2 Exposure of Sensitive Information to an Unauthorized Actor in nanoid | Medium | Also affects nanoid |
| GHSA-5849-834g-hvw5 pypdf has possible infinite loop when hitting EOF in standard xref table during trailer search | High | Same weakness, CWE-835 |
| GHSA-mfr5-77xh-9j7h pypdf has possible infinite loop when cloning dictionaries | High | Same weakness, CWE-835 |
| GHSA-h6cr-wjv9-3cpp Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891) | Low | Same weakness, CWE-835 |
| GHSA-fw5c-8223-6h42 russh: peer-declared zero maximum packet size permanently stalls channel writes (silent AsyncWrite hang) | Medium | Same weakness, CWE-835 |
Credits: CrzyHAX91, katzj, krassowski
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor