CVE-2026-67214

About vulnerability

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Affected product:

AlmaLinux 9.2 ESU , React , TuxCare 9.6 ESU , TuxCare 9.8 ESU , aegir , ai-sdk-angular , ai-sdk-assemblyai , ai-sdk-cerebras , ai-sdk-deepgram , ai-sdk-deepinfra , ai-sdk-deepseek , ai-sdk-elevenlabs , ai-sdk-fal , ai-sdk-gateway , ai-sdk-gladia , ai-sdk-harness , ai-sdk-harness-codex , ai-sdk-harness-cursor , ai-sdk-harness-deepagents , ai-sdk-harness-fx , ai-sdk-harness-opencode , ai-sdk-harness-pi , ai-sdk-hume , ai-sdk-langchain , ai-sdk-llamaindex , ai-sdk-lmnt , ai-sdk-luma , ai-sdk-otel , ai-sdk-policy-opa , ai-sdk-replicate , ai-sdk-revai , ai-sdk-rsc , ai-sdk-sandbox-just-bash , ai-sdk-sandbox-vercel , ai-sdk-togetherai , ai-sdk-valibot , ai-sdk-vercel , ai-sdk-workflow , ai-sdk-workflow-harness , beasties , beasties-webpack-plugin , clerk-astro , create-module-federation , eas-cli , electron-mocha , estimo , expo , expo-router , libp2p-interfaces-compliance-tests , livestore , livestore-adapter-cloudflare , livestore-adapter-web , livestore-common , livestore-common-cf , livestore-framework-toolkit , livestore-livestore , livestore-react , livestore-sqlite-wasm , livestore-sync-cf , livestore-sync-electric , livestore-utils , livestore-utils-dev , livestore-webmesh , mocha , module-federation-bridge-shared , module-federation-bridge-vue3 , module-federation-core , module-federation-devtools , module-federation-modern-js , module-federation-retry-plugin , module-federation-rsbuild-plugin , nanoid , nitro , octanejs-livestore , postcss , prisma , prisma-client-engine-runtime , size-limit , size-limit-esbuild , size-limit-esbuild-why , size-limit-file , size-limit-preset-app , size-limit-preset-big-lib , size-limit-preset-small-lib , size-limit-rolldown , size-limit-rolldown-why , size-limit-time , size-limit-webpack , size-limit-webpack-css , size-limit-webpack-why , vite , vite-plugin-beasties , wdio-mocha-framework , webpack-log , workflow , workflow-ai , workflow-astro , workflow-builders , workflow-cli , workflow-core , workflow-nest , workflow-next , workflow-nitro , workflow-nuxt , workflow-rollup , workflow-sveltekit , workflow-swc-plugin , workflow-utils , workflow-vite , workflow-vitest , workflow-web , workflow-web-shared , workflow-world , workflow-world-testing , workflow-world-vercel

Affected packages:

nanoid @ 3.3.12 (+1231 more)