Description
An integer overflow in nanoid(size) permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string "uuuuuuuuuuuuuuuuuuuuu".
Recommendation
Update the nanoid package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 5.1.11 < 3.3.12** Patched version(s): **5.1.11 3.3.12**
References
Could your website be exposed too?
SmartScanner can check your website for nanoid: Integer Overflow or Wraparound and gives you actionable findings to investigate.
Start a free scanRelated Issues
- js-toml vulnerable to CPU exhaustion via O(n^2) BigInt construction on radix-prefixed integer literals - CVE-2026-49293
- nanoid: custom generators can loop indefinitely when size is zero - CVE-2026-67213
- yaml is vulnerable to Stack Overflow via deeply nested YAML collections - CVE-2026-33532
- fast-xml-parser has stack overflow in XMLBuilder with preserveOrder - CVE-2026-27942
You might also like:
See something that needs correcting? Let us knowUpdated September 01, 2026