CVE-2026-67213
nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
CVE-2026-67213- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
EUVDEUVD-2026-50325
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
EUVD-2026-50325- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-2v37-7h3g-55p8
nanoid: custom generators can loop indefinitely when size is zero
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
GHSA-2v37-7h3g-55p8- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
NVD
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
CVE-2026-67213- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSV
nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
CVE-2026-67213- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-67213
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
DEBIAN-CVE-2026-67213- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 15 moreShow less
OSVGHSA-2v37-7h3g-55p8
nanoid: custom generators can loop indefinitely when size is zero
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
GHSA-2v37-7h3g-55p8- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-835
- Updated
- 2026-11-02
OSVRHSA-2026:47614
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:47614- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:47619
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- Record
RHSA-2026:47619- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2026:48241
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- Record
RHSA-2026:48241- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-67213
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
- Record
UBUNTU-CVE-2026-67213- CVSS 4.0
- 8.2 High
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 3.1
- 5.9 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVCLSA-2026-1790609840 No score
TuxCare security update for nanoid (4 CVEs)
TuxCare rebuilt nanoid to address 4 CVEs. Fixed in 3.3.7-tuxcare.2.
- Record
CLSA-2026-1790609840- Updated
- 2026-11-02
OSVCLSA-2026-1791196334 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.12-tuxcare.2.
- Record
CLSA-2026-1791196334- Updated
- 2026-11-02
OSVCLSA-2026-1791200139 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.16-tuxcare.2.
- Record
CLSA-2026-1791200139- Updated
- 2026-11-02
OSVCLSA-2026-1791208139 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.14-tuxcare.2.
- Record
CLSA-2026-1791208139- Updated
- 2026-11-02
OSVCLSA-2026-1791208360 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 5.1.5-tuxcare.1.
- Record
CLSA-2026-1791208360- Updated
- 2026-11-02
OSVCLSA-2026-1791282749 No score
TuxCare security update for nanoid (1 CVE)
TuxCare rebuilt nanoid to address 1 CVE. Fixed in 3.3.11-tuxcare.1.
- Record
CLSA-2026-1791282749- Updated
- 2026-11-02
OSVCLSA-2026-1791626324 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.6-tuxcare.2.
- Record
CLSA-2026-1791626324- Updated
- 2026-11-02
OSVCLSA-2026-1791626714 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.4-tuxcare.2.
- Record
CLSA-2026-1791626714- Updated
- 2026-11-02
OSVCLSA-2026-1791806453 No score
TuxCare security update for nanoid (2 CVEs)
TuxCare rebuilt nanoid to address 2 CVEs. Fixed in 3.3.8-tuxcare.1.
- Record
CLSA-2026-1791806453- Updated
- 2026-11-02
OSVROOT-APP-NPM-CVE-2026-67213 No score
CVE-2026-67213 in nanoid - Patched by Root
Root has patched CVE-2026-67213 in the nanoid package for Root:npm. Multiple fixed versions available.
- Record
ROOT-APP-NPM-CVE-2026-67213- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
nanoidnpm |
4.0.0 up to 5.1.6 | 5.1.6 |
nanoidnpm |
before 3.3.18 | 3.3.18 |
nanoidTuxCare:npm |
3.3.7-tuxcare.0 up to 3.3.7-tuxcare.2, plus listed versions 3.3.73.3.7-tuxcare.1 |
3.3.7-tuxcare.2 |
nanoidTuxCare:npm |
3.3.12-tuxcare.0 up to 3.3.12-tuxcare.2, plus listed versions 3.3.123.3.12-tuxcare.1 |
3.3.12-tuxcare.2 |
nanoidTuxCare:npm |
3.3.16-tuxcare.0 up to 3.3.16-tuxcare.2, plus listed versions 3.3.163.3.16-tuxcare.1 |
3.3.16-tuxcare.2 |
nanoidTuxCare:npm |
3.3.14-tuxcare.0 up to 3.3.14-tuxcare.2, plus listed versions 3.3.143.3.14-tuxcare.1 |
3.3.14-tuxcare.2 |
nanoidTuxCare:npm |
5.1.5-tuxcare.0 up to 5.1.5-tuxcare.1, plus listed versions 5.1.5 |
5.1.5-tuxcare.1 |
nanoidTuxCare:npm |
3.3.11-tuxcare.0 up to 3.3.11-tuxcare.1, plus listed versions 3.3.11 |
3.3.11-tuxcare.1 |
nanoidTuxCare:npm |
3.3.6-tuxcare.0 up to 3.3.6-tuxcare.2, plus listed versions 3.3.63.3.6-tuxcare.1 |
3.3.6-tuxcare.2 |
nanoidTuxCare:npm |
3.3.4-tuxcare.0 up to 3.3.4-tuxcare.2, plus listed versions 3.3.43.3.4-tuxcare.1 |
3.3.4-tuxcare.2 |
Show 15 moreShow less
| Package | Affected | Fixed |
|---|---|---|
nanoidTuxCare:npm |
3.3.8-tuxcare.0 up to 3.3.8-tuxcare.1, plus listed versions 3.3.8 |
3.3.8-tuxcare.1 |
node-mochaDebian:12 |
before 9.1.4+ds1+~cs28.2.8-1 | 9.1.4+ds1+~cs28.2.8-1 |
node-mochaDebian:13 |
before 9.1.4+ds1+~cs28.2.8-1 | 9.1.4+ds1+~cs28.2.8-1 |
node-mochaDebian:14 |
before 9.1.4+ds1+~cs28.2.8-1 | 9.1.4+ds1+~cs28.2.8-1 |
node-postcssDebian:12 |
All versions, plus listed versions 8.4.20+~cs8.0.23-18.4.20+~cs8.0.23-1+deb12u18.4.31+~cs8.0.26-18.4.39+~cs9.2.29-18.4.49+~cs9.2.32-1 Show 15 moreShow less8.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-18.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.31+~cs10.2.26-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
None known |
node-postcssDebian:13 |
All versions, plus listed versions 8.4.49+~cs9.2.32-18.5.12+~cs9.3.32-18.5.14+~cs9.3.34-18.5.15+~cs9.3.34-18.5.15+~cs9.3.38-1 Show 11 moreShow less8.5.15+~cs9.3.39-18.5.19+~cs10.2.23-18.5.21+~cs10.2.23-18.5.23+~cs10.2.23-18.5.25+~cs10.2.23-18.5.26+~cs10.2.24-18.5.28+~cs10.2.24-18.5.31+~cs10.2.26-18.5.6+~cs9.3.28-18.5.8+~cs9.3.30-18.5.9+~cs9.3.30-1 |
None known |
node-postcssDebian:14 |
before 8.5.8+~cs9.3.30-1, plus listed versions 8.4.49+~cs9.2.32-18.5.6+~cs9.3.28-1 |
8.5.8+~cs9.3.30-1 |
jaegerRed Hat:hummingbird:1 |
before 0:2.20.0-0.6.hum1 | 0:2.20.0-0.6.hum1 |
grafana12.4Red Hat:hummingbird:1 |
before 0:12.4.6-0.2.hum1 | 0:12.4.6-0.2.hum1 |
grafana13.1Red Hat:hummingbird:1 |
before 0:13.1.1-0.3.hum1 | 0:13.1.1-0.3.hum1 |
nanoidRoot:npm |
before 3.3.17-aikido.1 | 3.3.17-aikido.13.3.4-aikido.23.3.4-aikido.13.3.11-aikido.23.3.8-aikido.23.3.7-aikido.33.3.11-aikido.13.3.16-aikido.13.3.12-aikido.13.3.13-aikido.13.3.15-aikido.13.3.8-aikido.13.3.7-aikido.23.1.20-aikido.13.1.20-aikido.23.1.20-aikido.33.1.20-aikido.43.1.20-aikido.5 |
@rootio/nanoidRoot:npm |
before 3.3.17-root.io.1 | 3.3.17-root.io.13.3.4-root.io.23.3.4-root.io.13.3.11-root.io.23.3.8-root.io.23.3.7-root.io.33.3.11-root.io.13.3.16-root.io.13.3.12-root.io.13.3.13-root.io.13.3.15-root.io.13.3.8-root.io.13.3.7-root.io.23.1.20-root.io.13.1.20-root.io.23.1.20-root.io.33.1.20-root.io.43.1.20-root.io.5 |
node-postcssUbuntu:20.04:LTS |
All versions, plus listed versions 6.0.23-16.0.23-3 |
None known |
node-postcssUbuntu:22.04:LTS |
All versions, plus listed versions 8.2.1+~cs5.3.23-88.4.5+~cs7.1.51-28.4.6+~cs7.3.21-1 |
None known |
node-postcssUbuntu:24.04:LTS |
All versions, plus listed versions 8.4.20+~cs8.0.23-18.4.31+~cs8.0.26-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-67213 is a high vulnerability (CVSS 8.2) in Nanoid Project Nanoid, published July 29, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.33%, the 26th percentile. Fixed in nanoid 5.1.6.
References
github.com/ai/nanoid/releases/tag/5.1.6
vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
nvd.nist.gov/vuln/detail/CVE-2026-67213
Show 55 moreShow less
security-tracker.debian.org/tracker/CVE-2026-67213
access.redhat.com/errata/RHSA-2026:47614
images.redhat.com
security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_47614.json
bugzilla.redhat.com/show_bug.cgi?id=2508406
cve.org/CVERecord?id=CVE-2026-67213
grafana.com/security/security-advisories/cve-2026-42127
ubuntu.com/security/CVE-2026-67213