Integer Overflow or WraparoundAffected versions of this package are vulnerable to Integer Overflow or Wraparound through the fillPool logic in index.js and index.cjs. An attacker can make subsequent ID generation deterministic by supplying an oversized size value to nanoid(size), which is coerced into a negative 32-bit integer and corrupts the shared random pool state. After that call, all later IDs produced in the same process lose their randomness and uniqueness, breaking session tokens, CSRF tokens, and other identifiers until the process restarts.
How to fix Integer Overflow or Wraparound? Upgrade nanoid to version 3.3.12, 5.1.11 or higher.
| |
Infinite loopAffected versions of this package are vulnerable to Infinite loop through the customRandom function in the customRandom implementation. An attacker can hang the calling thread by supplying a size of 0 to customRandom, which causes its ID generation loop to never reach a terminating condition. This breaks any application path that accepts an unvalidated, attacker-controlled size and passes it into customRandom, leaving the process stuck while handling the request.
How to fix Infinite loop? Upgrade nanoid to version 3.3.17, 5.1.6 or higher.
| |
Infinite loopAffected versions of this package are vulnerable to Infinite loop through the customAlphabet and nanoid functions in nanoid/non-secure. An attacker can hang the calling thread by supplying a negative size to either function, causing the loop counter to decrement from a negative value and never reach its termination condition. This affects applications that pass unvalidated attacker-controlled size values into the non-secure ID generator, where a single malicious request can spin the process indefinitely and stop the service from responding.
Notes
- The vulnerable code path is in the
nanoid/non-secure entry point, so bundles or consumers that import the non-secure module directly are the ones exposed; the secure/default package path is a separate export.
- The denial-of-service only shows up when callers pass a negative
size into these APIs, which the advisory’s regression tests treat as returning an empty string rather than looping.
How to fix Infinite loop? Upgrade nanoid to version 3.3.16, 5.1.16 or higher.
| |
Improper Input ValidationAffected versions of this package are vulnerable to Improper Input Validation due to the mishandling of fractional values in the nanoid function. By exploiting this vulnerability, an attacker can achieve an infinite loop.
How to fix Improper Input Validation? Upgrade nanoid to version 3.3.8, 5.0.9 or higher.
| |
Information ExposureAffected versions of this package are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
How to fix Information Exposure? Upgrade nanoid to version 3.1.31 or higher.
| |
