Description
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread.
Recommendation
Update the nanoid package to the latest compatible version. Followings are version details:
Affected version(s): **>= 4.0.0, < 5.1.16 < 3.3.16** Patched version(s): **5.1.16 3.3.16**
References
Could your website be exposed too?
SmartScanner can check your website for nanoid: non-secure generators can loop indefinitely with negative size and gives you actionable findings to investigate.
Start a free scanRelated Issues
- nanoid: custom generators can loop indefinitely when size is zero - CVE-2026-67213
- jsrsasign is vulnerable to DoS through Infinite Loop when processing zero or negative inputs - CVE-2026-4598
- tarteaucitron: data-cookie attribute can be used to delete arbitrary cookies - CVE-2026-49977
- bn.js affected by an infinite loop - CVE-2026-2739
You might also like:
See something that needs correcting? Let us knowUpdated August 07, 2026