fix(deps): update dependency nanoid to v5.1.16 [security] - #652
Open
renovate[bot] wants to merge 1 commit into
Open
fix(deps): update dependency nanoid to v5.1.16 [security]#652renovate[bot] wants to merge 1 commit into
renovate[bot] wants to merge 1 commit into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
SafeDep Report Summary
Package Details
This report is generated by SafeDep GitHub App |
renovate
Bot
force-pushed
the
renovate/npm-nanoid-vulnerability
branch
from
September 2, 2026 14:19
27e9c62 to
bc2a657
Compare
renovate
Bot
force-pushed
the
renovate/npm-nanoid-vulnerability
branch
from
September 3, 2026 10:53
bc2a657 to
6a55168
Compare
renovate
Bot
force-pushed
the
renovate/npm-nanoid-vulnerability
branch
from
September 3, 2026 22:41
6a55168 to
4c69034
Compare
renovate
Bot
force-pushed
the
renovate/npm-nanoid-vulnerability
branch
from
September 7, 2026 21:56
4c69034 to
e2da084
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
5.1.6→5.1.16nanoid: non-secure generators can loop indefinitely with negative size
CVE-2026-67214 / GHSA-28wg-ghj8-5hjv
More information
Details
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
nanoid: custom generators can loop indefinitely when size is zero
CVE-2026-67213 / GHSA-2v37-7h3g-55p8
More information
Details
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Severity
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
nanoid: Integer Overflow or Wraparound
CVE-2026-73086 / GHSA-xwg4-73v4-xw9w
More information
Details
Summary
An integer overflow in
nanoid(size)permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string"uuuuuuuuuuuuuuuuuuuuu". Any application that passes user-influenced values to thesizeparameter loses all randomness guarantees for session tokens, CSRF tokens, and unique identifiers until process restart.Details
nanoid()atindex.js:101coerces thesizeparameter withsize |= 0, which converts it to a signed 32-bit integer. Whensize >= 2^31(e.g.,2147483648), this wraps to-2147483648.The negative value is passed to
fillPool()(index.js:15):Neither branch triggers, so the pool is never refreshed.
poolOffsetbecomes ~-2.1 billion.Subsequent
nanoid()calls execute:pool[negative_index]returnsundefined.undefined & 63evaluates to0.urlAlphabet[0]is'u'. Every ID becomes"uuuuuuuuuuuuuuuuuuuuu".The corruption is persistent — it affects all subsequent calls in the process until ~100 million calls eventually wrap
poolOffsetback to positive, or the process restarts.PoC
Run with:
node --experimental-vm-modules poc.mjsAttack scenario: Any API endpoint that accepts a user-controlled length/size parameter (URL shortener slug length, configurable token size, etc.) and passes it to
nanoid(userInput).Impact
Complete loss of ID unpredictability and uniqueness, process-wide, from a single request.
nanoidin the same processsizeparameter without validationSeverity
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:NReferences
This data is provided by the GitHub Advisory Database (CC-BY 4.0).
Release Notes
ai/nanoid (nanoid)
v5.1.16Compare Source
v5.1.15Compare Source
v5.1.14Compare Source
v5.1.13Compare Source
v5.1.12Compare Source
v5.1.11Compare Source
v5.1.10Compare Source
v5.1.9Compare Source
v5.1.8Compare Source
cusatomAlphabet75% faster (by @saripovdenis).v5.1.7Compare Source
--versionto CLI (by @mahmoodhamdi).nanoid.jsfor CDN (by @mahmoodhamdi).customRandomtypes (by @oguimbal).Configuration
📅 Schedule: (in timezone Asia/Shanghai)
🚦 Automerge: Enabled.
♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR was generated by Mend Renovate. View the repository job log.