GHSA-2v37-7h3g-55p8

Source

https://github.com/advisories/GHSA-2v37-7h3g-55p8

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2v37-7h3g-55p8/GHSA-2v37-7h3g-55p8.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-2v37-7h3g-55p8

Aliases

CVE-2026-67213

Downstream

CGA (190)

MINI (19)

Published

2026-07-29T15:31:12Z

Modified

2026-09-10T03:50:51Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

nanoid: custom generators can loop indefinitely when size is zero

Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Database specific

{
    "cwe_ids":  [
        "CWE-835"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-08-07T20:50:34Z",
    "nvd_published_at":  "2026-07-29T14:16:34Z",
    "severity":  "HIGH"
}

References

Affected packages

npm / nanoid

Package

Name: nanoid; View open source insights on deps.dev
Purl: pkg:npm/nanoid

Affected ranges

Type: SEMVER
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

3.3.18

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2v37-7h3g-55p8/GHSA-2v37-7h3g-55p8.json"

npm / nanoid

Package

Name: nanoid; View open source insights on deps.dev
Purl: pkg:npm/nanoid

Affected ranges

Type: SEMVER
Events: Introduced

4.0.0

Fixed

5.1.6

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-2v37-7h3g-55p8/GHSA-2v37-7h3g-55p8.json"