nanoid: custom generators can loop indefinitely when size is zero

Description

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread.

Recommendation

Update the nanoid package to the latest compatible version. Followings are version details:

• Affected version(s): **< 3.3.18

  >= 4.0.0, < 5.1.6**

• Patched version(s): **3.3.18

  5.1.6**

References

• GHSA-2v37-7h3g-55p8
• www.vulncheck.com
• CVE-2026-67213
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• nanoid: non-secure generators can loop indefinitely with negative size - CVE-2026-67214
• jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
• Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser - CVE-2026-33349
• Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() - CVE-2026-39315

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nanoid