Security vulnerabilities and automated fixes for nanoid issues
3 posts found
A high-severity infinite loop vulnerability (CVE-2026-67213) was discovered in nanoid versions before 5.1.6 and 3.3.17, affecting the custom alphabet generation feature. When processing certain malformed alphabet configurations, nanoid would enter an infinite loop, causing a complete denial of service. This vulnerability was fixed by upgrading from nanoid 3.3.16 to 3.3.17 and implementing dependency overrides to ensure the patched version is used throughout the dependency tree.
A high-severity vulnerability in the nanoid package (CVE-2026-67213) allowed attackers to trigger infinite loops through the customAlphabet function, potentially causing complete denial of service. This fix upgrades nanoid from version 3.3.16 to 3.3.17 in the app_store dependency tree, eliminating the DoS risk through a simple version override.
A high-severity infinite loop vulnerability (CVE-2026-67213) was discovered in the nanoid package's `customAlphabet` function, affecting versions before 5.1.6. The concord-frontend application depended on nanoid 6.0.1, which contained this flaw. The fix downgrades to nanoid 3.3.17, a patched version that eliminates the infinite loop condition triggered by crafted input to custom alphabet ID generation.