DEBIAN-CVE-2026-67213

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-67213
Import Source
https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67213.json
JSON Data
https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-67213
Upstream
Published
2026-07-29T14:16:34Z
Modified
2026-09-14T17:03:28Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

References

Affected packages

Debian:12
node-mocha

Package

Name
node-mocha
Purl
pkg:deb/debian/node-mocha?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.1.4+ds1+~cs28.2.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67213.json"
node-postcss

Package

Name
node-postcss
Purl
pkg:deb/debian/node-postcss?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

8.*
8.4.20+~cs8.0.23-1
8.4.20+~cs8.0.23-1+deb12u1
8.4.31+~cs8.0.26-1
8.4.39+~cs9.2.29-1
8.4.49+~cs9.2.32-1
8.5.6+~cs9.3.28-1
8.5.8+~cs9.3.30-1
8.5.9+~cs9.3.30-1
8.5.12+~cs9.3.32-1
8.5.14+~cs9.3.34-1
8.5.15+~cs9.3.34-1
8.5.15+~cs9.3.38-1
8.5.15+~cs9.3.39-1
8.5.19+~cs10.2.23-1
8.5.21+~cs10.2.23-1
8.5.23+~cs10.2.23-1
8.5.25+~cs10.2.23-1
8.5.26+~cs10.2.24-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67213.json"
Debian:13
node-mocha

Package

Name
node-mocha
Purl
pkg:deb/debian/node-mocha?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.1.4+ds1+~cs28.2.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67213.json"
node-postcss

Package

Name
node-postcss
Purl
pkg:deb/debian/node-postcss?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

8.*
8.4.49+~cs9.2.32-1
8.5.6+~cs9.3.28-1
8.5.8+~cs9.3.30-1
8.5.9+~cs9.3.30-1
8.5.12+~cs9.3.32-1
8.5.14+~cs9.3.34-1
8.5.15+~cs9.3.34-1
8.5.15+~cs9.3.38-1
8.5.15+~cs9.3.39-1
8.5.19+~cs10.2.23-1
8.5.21+~cs10.2.23-1
8.5.23+~cs10.2.23-1
8.5.25+~cs10.2.23-1
8.5.26+~cs10.2.24-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67213.json"
Debian:14
node-mocha

Package

Name
node-mocha
Purl
pkg:deb/debian/node-mocha?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
9.1.4+ds1+~cs28.2.8-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67213.json"
node-postcss

Package

Name
node-postcss
Purl
pkg:deb/debian/node-postcss?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.5.8+~cs9.3.30-1

Affected versions

8.*
8.4.49+~cs9.2.32-1
8.5.6+~cs9.3.28-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67213.json"