CVE-2026-67214 Details
Description
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
A denial-of-service vulnerability has been identified in nanoid (Nano ID) versions prior to 5.1.16. The issue resides in the customAlphabet and nanoid functions of the non-secure module. When these functions receive a negative size, they enter an infinite loop, as the loop counter is decremented from a negative value and fails to meet the termination condition. This causes the loop to spin indefinitely, freezing the calling thread. Applications that pass unvalidated, attacker-controlled negative sizes to these functions can be exploited, leading to a denial-of-service condition.
Users can upgrade to nanoid version 5.1.16 or later, where this issue has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49 | [email protected] | Patch |
| https://github.com/ai/nanoid/releases/tag/3.3.16 | [email protected] | ProductRelease Notes |
| https://github.com/ai/nanoid/releases/tag/5.1.16 | [email protected] | ProductRelease Notes |
| https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module | [email protected] | PatchRelease NotesThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-835 | Loop with Unreachable Exit Condition ('Infinite Loop') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| nanoid project nanoid | < 3.3.16 >= 5.0.0, < 5.1.16 |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 26, 2026 | Modified Analysis | [email protected] |
| Aug 19, 2026 | CVE Modified | [email protected] |
| Aug 18, 2026 | Initial Analysis | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |