CVE-2026-67213
Medium
Description
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
SeverityMedium
CVSS5.9
Exploit probability—
ProductNanoid
PublishedJul 29, 2026
First seenJul 29, 2026
Weakness typeCWE-835CWE-835
How to fix
Update
- nanoid_project nanoid3.3.17, 5.1.6 or later
- nanoid3.3.18, 5.1.6 or later
Vendor advisories
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nanoid_project nanoid | 3.0.0 ≤ v < 3.3.17, 5.0.0 ≤ v < 5.1.6 | 3.3.17, 5.1.6 |
| nanoidnpm | v < 3.3.18, 4.0.0 ≤ v < 5.1.6 | 3.3.18, 5.1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.