CVE-2026-67213

About vulnerability

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Affected product:

AngularJS , Bootstrap , Next.js , React , Vue , ag-grid , astro , autoprefixer , babel-plugin-jsx , beasties , core , critters , css-declaration-sorter , css-loader , css-minimizer-webpack-plugin , cssnano , devtools , head , icss-utils , impound , jsx-vue2 , loopback , loopback-connector-remote , loopback-datasource-juggler , nanoid , nitro , nuxt , optimize-css-assets-webpack-plugin , postcss , postcss-attribute-case-insensitive , postcss-calc , postcss-charset , postcss-clamp , postcss-color-hex-alpha , postcss-color-rebeccapurple , postcss-colormin , postcss-custom-media , postcss-custom-selectors , postcss-discard-duplicates , postcss-font-variant , postcss-import , postcss-js , postcss-load-config , postcss-loader , postcss-modules , postcss-modules-extract-imports , postcss-modules-local-by-default , postcss-modules-scope , postcss-modules-values , postcss-nested , postcss-nesting , postcss-opacity-percentage , postcss-ordered-values , postcss-page-break , postcss-plugins , postcss-replace-overflow-wrap , postcss-selector-not , postcss-svgo , postcss-url , purgecss , remix , shortid , storybook , tailwindcss , telemetry , unhead , unimport , unplugin , unplugin-vue-router , vanilla-extract , vite , vite-dev-rpc , vite-hot-client , vite-node , vite-plugin-basic-ssl , vite-plugin-checker , vite-plugin-inspect , vite-plugin-vue , vite-plugin-vue-inspector , vite-plugin-vue-tracer , vitefu

Affected packages:

@vue/server-renderer @ 3.5.40 (+648 more)