Description
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread.
Recommendation
Update the nanoid package to the latest compatible version. Followings are version details:
Affected version(s): **< 3.3.18 >= 4.0.0, < 5.1.6** Patched version(s): **3.3.18 5.1.6**
References
Could your website be exposed too?
SmartScanner can check your website for nanoid: custom generators can loop indefinitely when size is zero and gives you actionable findings to investigate.
Start a free scanRelated Issues
- nanoid: non-secure generators can loop indefinitely with negative size - CVE-2026-67214
- jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
- Entity Expansion Limits Bypassed When Set to Zero Due to JavaScript Falsy Evaluation in fast-xml-parser - CVE-2026-33349
- Unhead has a hasDangerousProtocol() bypass via leading-zero padded HTML entities in useHeadSafe() - CVE-2026-39315
You might also like:
See something that needs correcting? Let us knowUpdated August 13, 2026