CVE-2026-67213

CVE-2026-67213 (nanoid) affects Nano ID before 5.1.6. A bug in the customAlphabet and customRandom functions can enter an infinite loop when configured with a size of 0, causing the generation loop to spin and hang the calling thread. This creates a denial-of-service condition if an attacker can ...

CVE-2026-67214

CVE-2026-67214 (nanoid) affects the Nano ID package prior to 5.1.16, specifically the non-secure module (nanoid/non-secure). The vulnerability is an infinite loop in the customAlphabet and nanoid functions when given a negative size, causing the loop counter to decrement from a negative value and...

CVE-2021-23566

CVE-2021-23566 affects nanoid versions 3.0.0 through before 3.1.31, where Information Exposure is possible via valueOf(), allowing reproduction of the last generated ID. Root cause is an information disclosure in valueOf(). Remediation: upgrade to nanoid 3.1.31 or later (the fixed version). Note:...