What’s Vulnerable › Vulnerabilities

CVE-2026-67213: nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-29 · updated 2026-10-23
• Weakness: CWE-835

Description

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Affected products

• nanoid_project nanoid: from 3.0.0 before 3.3.17; from 5.0.0 before 5.1.6 — fixed in 3.3.17, 5.1.6

How to fix

Upgrade to a fixed version: nanoid_project nanoid 3.3.17, 5.1.6. Check the vendor advisory for mitigations.

References

• https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
• https://github.com/ai/nanoid/releases/tag/5.1.6
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom

Get alerted when CVE-2026-67213 or the next vulnerability affects your stack