~ / search / GHSA-2v37-7h3g-55p8

GHSA-2v37-7h3g-55p8

nanoid: custom generators can loop indefinitely when size is zero

Source: GitHub Advisory Database (reviewed) High CVE-2026-67213

Packages

EcosystemPackageAffectedFixed in
npm nanoid < 3.3.18 3.3.18
npm nanoid >= 4.0.0, < 5.1.6 5.1.6

Details

As written in the advisory (Markdown source, shown as plain text).

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

References

External links from the advisory. They lead to third-party sites.