CVE-2026-67213

About vulnerability

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Affected product:

AngularJS , Bootstrap , Next.js , React , Vue , aegir , ag-grid , angular-pwa , astro , astrojs-internal-helpers , astrojs-prism , astrojs-studio , astrojs-underscore-redirects , astrojs-upgrade , autoprefixer , babel-plugin-jsx , beasties , beasties-webpack-plugin , clerk-astro , core , create-next-app , critters , css-blank-pseudo , css-declaration-sorter , css-has-pseudo , css-loader , css-minimizer-webpack-plugin , css-prefers-color-scheme , cssnano , cssnano-preset-default , cssnano-utils , csstools-cascade-layer-name-parser , csstools-color-helpers , csstools-media-query-list-parser , csstools-postcss-bundler , csstools-postcss-cascade-layers , csstools-postcss-color-function , csstools-postcss-color-mix-function , csstools-postcss-conditional-values , csstools-postcss-container-rule-prelude-list , csstools-postcss-content-alt-text , csstools-postcss-design-tokens , csstools-postcss-fit-tolerance-property , csstools-postcss-gradient-stop-increments-experimental , csstools-postcss-hwb-function , csstools-postcss-ic-unit , csstools-postcss-initial , csstools-postcss-is-pseudo-class , csstools-postcss-light-dark-function , csstools-postcss-logical-float-and-clear , csstools-postcss-logical-overflow , csstools-postcss-logical-overscroll-behavior , csstools-postcss-logical-resize , csstools-postcss-logical-viewport-units , csstools-postcss-media-minmax , csstools-postcss-media-queries-aspect-ratio-number-values , csstools-postcss-minify , csstools-postcss-nested-calc , csstools-postcss-oklab-function , csstools-postcss-private-rule , csstools-postcss-rebase-url , csstools-postcss-relative-color-syntax , csstools-postcss-rewrite-url , csstools-postcss-scope-pseudo-class , csstools-postcss-stepped-value-functions , csstools-postcss-text-decoration-shorthand , csstools-postcss-trigonometric-functions , csstools-postcss-unset-value , devtools , eas-cli , electron-mocha , estimo , expo , expo-router , head , icss-utils , impound , jsx-vue2 , libp2p-interfaces-compliance-tests , livestore , livestore-adapter-cloudflare , livestore-adapter-web , livestore-common , livestore-common-cf , livestore-framework-toolkit , livestore-livestore , livestore-react , livestore-sqlite-wasm , livestore-sync-cf , livestore-sync-electric , livestore-utils , livestore-utils-dev , livestore-webmesh , loopback , loopback-connector-remote , loopback-datasource-juggler , mocha , nanoid , nitro , nuxt , nuxt-kit , nuxt-rspack-builder , nuxt-schema , nuxt-vite-builder , nuxt-webpack-builder , octanejs-livestore , optimize-css-assets-webpack-plugin , postcss , postcss-attribute-case-insensitive , postcss-calc , postcss-charset , postcss-clamp , postcss-color-functional-notation , postcss-color-hex-alpha , postcss-color-rebeccapurple , postcss-colormin , postcss-convert-values , postcss-custom-media , postcss-custom-selectors , postcss-dir-pseudo-class , postcss-discard-comments , postcss-discard-duplicates , postcss-discard-empty , postcss-discard-overridden , postcss-discard-unused , postcss-focus-visible , postcss-focus-within , postcss-font-variant , postcss-gap-properties , postcss-image-set-function , postcss-import , postcss-js , postcss-load-config , postcss-loader , postcss-logical , postcss-merge-idents , postcss-merge-longhand , postcss-merge-rules , postcss-minify-font-values , postcss-minify-gradients , postcss-minify-params , postcss-minify-selectors , postcss-modules , postcss-modules-extract-imports , postcss-modules-local-by-default , postcss-modules-scope , postcss-modules-values , postcss-nested , postcss-nesting , postcss-normalize-display-values , postcss-normalize-positions , postcss-normalize-repeat-style , postcss-normalize-string , postcss-normalize-timing-functions , postcss-normalize-unicode , postcss-normalize-url , postcss-normalize-whitespace , postcss-opacity-percentage , postcss-ordered-values , postcss-overflow-shorthand , postcss-page-break , postcss-place , postcss-plugins , postcss-pseudo-class-any-link , postcss-reduce-idents , postcss-reduce-initial , postcss-replace-overflow-wrap , postcss-selector-not , postcss-svgo , postcss-unique-selectors , postcss-url , postcss-zindex , prisma , prisma-client-engine-runtime , purgecss , remix , remix-run-server-runtime , sb , shortid , size-limit , size-limit-esbuild , size-limit-esbuild-why , size-limit-file , size-limit-preset-app , size-limit-preset-big-lib , size-limit-preset-small-lib , size-limit-rolldown , size-limit-rolldown-why , size-limit-time , size-limit-webpack , size-limit-webpack-css , size-limit-webpack-why , storybook , storybook-addon-actions , storybook-addon-backgrounds , storybook-addon-controls , storybook-addon-docs , storybook-addon-essentials , storybook-addon-highlight , storybook-addon-interactions , storybook-addon-measure , storybook-addon-outline , storybook-addon-toolbars , storybook-addon-viewport , storybook-angular , storybook-blocks , storybook-builder-manager , storybook-builder-vite , storybook-builder-webpack5 , storybook-channel-postmessage , storybook-channels , storybook-cli , storybook-client-logger , storybook-codemod , storybook-components , storybook-core-client , storybook-core-common , storybook-core-events , storybook-core-server , storybook-core-webpack , storybook-csf-plugin , storybook-csf-tools , storybook-docs-tools , storybook-ember , storybook-html , storybook-html-vite , storybook-html-webpack5 , storybook-instrumenter , storybook-manager , storybook-manager-api , storybook-nextjs , storybook-node-logger , storybook-preact , storybook-preact-vite , storybook-preact-webpack5 , storybook-preset-html-webpack , storybook-preset-preact-webpack , storybook-preset-react-webpack , storybook-preset-server-webpack , storybook-preset-svelte-webpack , storybook-preset-vue3-webpack , storybook-preview , storybook-preview-api , storybook-react , storybook-react-dom-shim , storybook-react-vite , storybook-react-webpack5 , storybook-router , storybook-server , storybook-server-webpack5 , storybook-svelte , storybook-svelte-vite , storybook-svelte-webpack5 , storybook-sveltekit , storybook-telemetry , storybook-theming , storybook-types , storybook-vue3 , storybook-vue3-vite , storybook-vue3-webpack5 , storybook-web-components , storybook-web-components-vite , storybook-web-components-webpack5 , stylehacks , tailwindcss , telemetry , unhead , unhead-dom , unhead-schema , unhead-shared , unhead-ssr , unhead-vue , unimport , unplugin , unplugin-vue-router , vanilla-extract , vite , vite-dev-rpc , vite-hot-client , vite-node , vite-plugin-basic-ssl , vite-plugin-beasties , vite-plugin-checker , vite-plugin-inspect , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer , vitefu , wdio-mocha-framework , webpack-log

Affected packages:

nanoid @ 3.3.16 (+1272 more)