Security vulnerabilities and automated fixes for nanoid issues
11 posts found
An integer overflow in nanoid 3.3.11's internal randomness generation causes the library to fall back to predictable ID sequences, undermining the cryptographic guarantees of its supposedly unguessable identifiers. The fix upgrades the dependency tree to patched versions 3.3.12 or 5.1.11.
nanoid, a widely-used ID generator pulled in transitively through postcss and vitepress, had an infinite-loop bug in its `customAlphabet` code path before version 5.1.6. This PR pins the entire dependency tree to nanoid 5.1.16 via a pnpm override so no transitive consumer can resolve back to the vulnerable 3.3.16 release.
CVE-2026-67213 is a high-severity infinite loop vulnerability in nanoid's `customAlphabet` function that could cause Denial of Service through CPU exhaustion. The fix upgrades nanoid from 3.3.12 to patched versions 3.3.18 and 5.1.6, eliminating the loop condition that trapped ID generation when processing certain input patterns.
A critical vulnerability in nanoid versions 3.3.16 and below allowed attackers to trigger infinite loops during random ID generation, causing complete CPU exhaustion and denial of service. The fix upgrades to nanoid 3.3.18, which patches the underlying random number generation flaw that could freeze Node.js applications processing untrusted input.
A high-severity vulnerability in the nanoid package (CVE-2026-67213) could trigger an infinite loop in random ID generation when processing specially crafted input. This fix upgrades nanoid from version 3.3.12 to 3.3.18 and 5.1.6, eliminating the denial-of-service attack vector in the frontend application's dependency tree.
A Denial of Service vulnerability in nanoid versions prior to 3.3.18 allowed attackers to trigger an infinite loop during random ID generation, potentially hanging Node.js processes indefinitely. The fix upgrades nanoid from 3.3.16 to 3.3.18 in both `package-lock.json` and `package.json`, and adds an `overrides` entry to ensure the patched version is enforced across the entire dependency tree. This is a high-severity issue that any project using nanoid for ID generation—directly or transitively—
A high-severity denial of service vulnerability (CVE-2026-67213) was discovered in nanoid versions before 5.1.6 and 3.3.18, where the `customAlphabet` function could enter an infinite loop during random ID generation. The fix upgrades the transitive nanoid dependency from 3.3.16 to 3.3.18 using pnpm overrides, ensuring the vulnerable code path is eliminated from the entire dependency tree including PostCSS.
CVE-2026-67213 is a high-severity Denial of Service vulnerability in the popular nanoid JavaScript library, where a flaw in the `customAlphabet` random ID generation function could trigger an infinite loop, hanging the Node.js process indefinitely. The fix upgrades nanoid from version 3.3.11 to 3.3.18 (and adds a package-level override to enforce the safe version across the dependency tree) in the client application. Any application using nanoid's custom alphabet feature with attacker-influenced
CVE-2026-67213 is a high-severity Denial of Service vulnerability in the popular nanoid package, where a flaw in the custom alphabet ID generation logic could trigger an infinite loop, hanging the process indefinitely. The fix upgrades nanoid from 3.3.16 to 3.3.18 (and pins the 5.x branch to 5.1.6), patching the loop condition so that all valid alphabet inputs terminate correctly. Any Node.js or Bun application using nanoid's `customAlphabet` function with user-influenced input is potentially af
A high-severity infinite loop vulnerability (CVE-2026-67213) was discovered in nanoid versions before 5.1.6 and 3.3.17, affecting the custom alphabet generation feature. When processing certain malformed alphabet configurations, nanoid would enter an infinite loop, causing a complete denial of service. This vulnerability was fixed by upgrading from nanoid 3.3.16 to 3.3.17 and implementing dependency overrides to ensure the patched version is used throughout the dependency tree.
A high-severity vulnerability in the nanoid package (CVE-2026-67213) allowed attackers to trigger infinite loops through the customAlphabet function, potentially causing complete denial of service. This fix upgrades nanoid from version 3.3.16 to 3.3.17 in the app_store dependency tree, eliminating the DoS risk through a simple version override.