CVE-2026-67214: nanoid: non-secure generators can loop indefinitely with negative size
(updated )
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
References
- github.com/advisories/GHSA-28wg-ghj8-5hjv
- github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
- github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d
- github.com/ai/nanoid/pull/600
- github.com/ai/nanoid/pull/601
- github.com/ai/nanoid/releases/tag/5.1.16
- nvd.nist.gov/vuln/detail/CVE-2026-67214
- www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
Code Behaviors & Features
Detect and mitigate CVE-2026-67214 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →