Homepage

Numeric Range Comparison Without Minimum Check The advisory has been revoked - it doesn't affect any version of package grafana  (opens in a new tab)

Threat Intelligence

EPSS
0.33% (27th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CENTOS10-GRAFANA-19264130
  • published26 Aug 2026
  • disclosed29 Jul 2026
Report a new vulnerability Found a mistake?

Introduced: 29 Jul 2026

CVE-2026-67214  (opens in a new tab)
CWE-839  (opens in a new tab)

Amendment

The Centos security team deemed this advisory irrelevant for Centos:10.

NVD Description

Note: Versions mentioned in the description apply only to the upstream grafana package and not the grafana package as distributed by Centos.

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.