CVE-2026-73086

CVE-2026-73086 affects the nanoid JavaScript library. Prior to versions 3.3.12 and 5.1.11 , nanoid’s nanoid(size) coerces the user-provided size to a signed 32-bit int, which can wrap 2147483648 to -2147483648. This corrupts the process-wide CSPRNG poolOffset in fillPool(), causing subsequent ses...