Medium severity5.9NVD Advisory· Published Jul 29, 2026· Updated Aug 18, 2026
CVE-2026-67213
CVE-2026-67213
Description
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
nanoidnpm | < 3.3.18 | 3.3.18 |
nanoidnpm | >= 4.0.0, < 5.1.6 | 5.1.6 |
Affected products
50- osv-coords48 versionspkg:apk/chainguard/arangodb-3.11pkg:apk/chainguard/arangodb-3.12pkg:apk/chainguard/authentik-2025.12pkg:apk/chainguard/dotstatsuite-supercorepkg:apk/chainguard/gitlab-rails-ce-18.1pkg:apk/chainguard/gitlab-rails-ce-19.0pkg:apk/chainguard/gitlab-rails-ce-19.1pkg:apk/chainguard/gitlab-rails-ce-19.2pkg:apk/chainguard/gitlab-rails-ce-19.3pkg:apk/chainguard/gitlab-rails-ce-fips-18.1pkg:apk/chainguard/gitlab-rails-ce-fips-19.1pkg:apk/chainguard/gitlab-rails-ce-fips-19.2pkg:apk/chainguard/homepagepkg:apk/chainguard/jitsucom-jitsu-consolepkg:apk/chainguard/json-serverpkg:apk/chainguard/keep-uipkg:apk/chainguard/keep-ui-fipspkg:apk/chainguard/langfuse-2pkg:apk/chainguard/langfuse-2-workerpkg:apk/chainguard/langfuse-3pkg:apk/chainguard/langfuse-3-workerpkg:apk/chainguard/langfuse-4pkg:apk/chainguard/langfuse-4-workerpkg:apk/chainguard/langfuse-fips-2pkg:apk/chainguard/langfuse-fips-2-workerpkg:apk/chainguard/langfuse-fips-3pkg:apk/chainguard/langfuse-fips-3-workerpkg:apk/chainguard/langfuse-fips-4pkg:apk/chainguard/langfuse-fips-4-workerpkg:apk/chainguard/nextcloud-server-31pkg:apk/chainguard/nextcloud-server-33pkg:apk/chainguard/pelias-apipkg:apk/chainguard/renovatepkg:apk/chainguard/safpkg:apk/chainguard/unleashpkg:apk/chainguard/unleash-fipspkg:apk/chainguard/vitepkg:apk/chainguard/vitess-23pkg:apk/wolfi/jitsucom-jitsu-consolepkg:apk/wolfi/json-serverpkg:apk/wolfi/langfuse-3pkg:apk/wolfi/langfuse-3-workerpkg:apk/wolfi/nextcloud-server-33pkg:apk/wolfi/renovatepkg:apk/wolfi/safpkg:apk/wolfi/vitepkg:apk/wolfi/vitess-23pkg:npm/nanoid
< 3.11.14.4-r18+ 47 more
- (no CPE)range: < 3.11.14.4-r18
- (no CPE)range: < 3.12.9.4-r21
- (no CPE)range: < 2025.12.6-r7
- (no CPE)range: < 3.1.0_git20260803-r2
- (no CPE)range: < 18.1.6-r28
- (no CPE)range: < 19.0.5-r20
- (no CPE)range: < 19.1.3-r6
- (no CPE)range: < 19.2.4-r3
- (no CPE)range: < 19.3.1-r1
- (no CPE)range: < 18.1.6-r90
- (no CPE)range: < 19.1.6-r1
- (no CPE)range: < 19.2.1-r7
- (no CPE)range: < 1.13.2-r11
- (no CPE)range: < 2.11.0-r32
- (no CPE)range: < 0.17.4-r11
- (no CPE)range: < 0.54.2-r4
- (no CPE)range: < 0.54.2-r7
- (no CPE)range: < 2.95.12-r42
- (no CPE)range: < 2.95.12-r42
- (no CPE)range: < 3.225.1-r1
- (no CPE)range: < 3.225.1-r1
- (no CPE)range: < 4.6.0-r0
- (no CPE)range: < 4.6.0-r0
- (no CPE)range: < 2.95.12-r44
- (no CPE)range: < 2.95.12-r44
- (no CPE)range: < 3.224.3-r12
- (no CPE)range: < 3.224.3-r12
- (no CPE)range: < 4.6.0-r2
- (no CPE)range: < 4.6.0-r2
- (no CPE)range: < 31.0.14-r7
- (no CPE)range: < 33.0.7-r3
- (no CPE)range: < 7.9.0-r2
- (no CPE)range: < 44.23.3-r1
- (no CPE)range: < 1.6.0-r4
- (no CPE)range: < 8.1.0-r1
- (no CPE)range: < 8.1.0-r1
- (no CPE)range: < 8.2.1-r1
- (no CPE)range: < 23.0.5-r8
- (no CPE)range: < 2.11.0-r32
- (no CPE)range: < 0.17.4-r11
- (no CPE)range: < 3.225.1-r1
- (no CPE)range: < 3.225.1-r1
- (no CPE)range: < 33.0.7-r3
- (no CPE)range: < 44.23.3-r1
- (no CPE)range: < 1.6.0-r4
- (no CPE)range: < 8.2.1-r1
- (no CPE)range: < 23.0.5-r8
- (no CPE)range: < 3.3.18
Patches
Vulnerability mechanics
References
9- github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7nvdPatchWEB
- www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandomnvdPatchRelease NotesThird Party AdvisoryWEB
- github.com/advisories/GHSA-2v37-7h3g-55p8ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-67213ghsaADVISORY
- github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0ghsaWEB
- github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49bghsaWEB
- github.com/ai/nanoid/releases/tag/3.3.17ghsaWEB
- github.com/ai/nanoid/releases/tag/3.3.18ghsaWEB
- github.com/ai/nanoid/releases/tag/5.1.6nvdProductRelease NotesWEB
News mentions
0No linked articles in our index yet.