nanoid: non-secure generators can loop indefinitely with negative size

Description

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread.

Recommendation

Update the nanoid package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 4.0.0, < 5.1.16

  < 3.3.16**

• Patched version(s): **5.1.16

  3.3.16**

References

• GHSA-28wg-ghj8-5hjv
• www.vulncheck.com
• CVE-2026-67214
• CWE-835
• CAPEC-310
• OWASP 2021-A6

Related Issues

• nanoid: custom generators can loop indefinitely when size is zero - CVE-2026-67213
• jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
• tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies - CVE-2026-49977
• bn.js affected by an infinite loop - CVE-2026-2739

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

nanoid