CVE-2021-23566

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-23566
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23566.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-23566
Aliases
Downstream
Related
  • SNYK-JAVA-ORGWEBJARSNPM-2332550
  • SNYK-JS-NANOID-2332193
Published
2022-01-14T20:15:10.093Z
Modified
2026-02-09T22:13:18.755152Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

References

Affected packages

Git / github.com/ai/nanoid

Affected ranges

Type
GIT
Repo
https://github.com/ai/nanoid
Events
Fixed
2b7bd9332bc49b6330c7ddb08e5c661833db2575
Introduced
7b45b890ce9cba85c8dc08fdb7ad401b966ed067
Fixed
2b7bd9332bc49b6330c7ddb08e5c661833db2575

Affected versions

3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.28
3.1.29
3.1.30
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-23566.json"