npm package
nanoid
pkg:npm/nanoid
Vulnerabilities (3)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2026-67213 | Med | 5.9 | < 3.3.18 | 3.3.18 | Jul 29, 2026 | nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An a | |
| CVE-2024-55565 | Med | 4.3 | >= 4.0.0, < 5.0.9 | 5.0.9 | Dec 9, 2024 | nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version. | |
| CVE-2021-23566 | Med | 4.0 | >= 3.0.0, < 3.1.31 | 3.1.31 | Jan 14, 2022 | The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated. |
- affected < 3.3.18fixed 3.3.18
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An a
- affected >= 4.0.0, < 5.0.9fixed 5.0.9
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
- affected >= 3.0.0, < 3.1.31fixed 3.1.31
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.