Security vulnerabilities and automated fixes for cve 2026 67213 issues
2 posts found
A high-severity infinite loop vulnerability (CVE-2026-67213) was discovered in nanoid versions before 5.1.6 and 3.3.17, affecting the custom alphabet generation feature. When processing certain malformed alphabet configurations, nanoid would enter an infinite loop, causing a complete denial of service. This vulnerability was fixed by upgrading from nanoid 3.3.16 to 3.3.17 and implementing dependency overrides to ensure the patched version is used throughout the dependency tree.
A high-severity infinite loop vulnerability (CVE-2026-67213) was discovered in the nanoid package's `customAlphabet` function, affecting versions before 5.1.6. The concord-frontend application depended on nanoid 6.0.1, which contained this flaw. The fix downgrades to nanoid 3.3.17, a patched version that eliminates the infinite loop condition triggered by crafted input to custom alphabet ID generation.