Infinite Loop

🗓️ 06 Aug 2026 05:47:52Reported by Veracode Vulnerability DatabaseType

veracode🔗 sca.analysiscenter.veracode.com👁 21 Views

nanoid infinite loop when negative size is given to customAlphabet or nanoid causing service outage.

Reporter	Title	Published	Views	Family All 297
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affects IBM Db2 Big SQL on IBM Software Hub	10 Sep 202610:50	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses nanoid-3.3.11.tgz which is vulnerable to CVE-2026-67213, CVE-2026-67214	31 Aug 202618:23	–	ibm
IBM Security Bulletins	Security Bulletin: Security vulnerability in JavaScript affects IBM Robotic Process Automation and IBM Robotic Process Automation for Cloud Pak	9 Oct 202613:28	–	ibm
IBM Security Bulletins	Security Bulletin: nanoid-3.3.18.tgz (Publicly disclosed vulnerability found by Scanner)	17 Sep 202620:24	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by multiple vulnerabilities in nanoid (CVE-2026-67213, CVE-2026-67214)	28 Sep 202607:09	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - Cluster Performance Insights uses nanoid-3.3.12.tgz and dompurify-3.4.12.tgz which are vulnerable to CVE-2026-67213, CVE-2026-67214 and CVE-2026-75838	1 Oct 202609:58	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data has several vulnerabilities due to open source software	21 Sep 202613:21	–	ibm
IBM Security Bulletins	Security Bulletin: There are vulnerabilities in IBM Maximo Manage application in IBM Maximo Application Suite	28 Aug 202606:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security QRadar Log Management AQL Plugin contains components with known vulnerabilities	21 Sep 202618:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities affect IBM Decision Optimization for Cloud Pak for Data.	28 Sep 202608:43	–	ibm

Vulners

Node

nanoid_project nanoidRange4.0.0–5.1.11js

nanoid_project nanoidRange1.1.0–3.3.15js

nanoid_project nanoidRange4.0.0–5.1.15js

nanoid_project nanoidRange1.1.0–3.3.15js

nanoid_project nanoidRange0.1.0–3.3.15js

Source	Link
github	www.github.com/ai/nanoid/releases/tag/5.1.16
github	www.github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
github	www.github.com/ai/nanoid/releases/tag/3.3.16
vulncheck	www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module

11 Sep 2026 21:43Current

6.9Medium risk

Vulners AI Score6.9

CVSS 3.15.9 - 7.5

CVSS 48.2

EPSS0.0033

SSVC