CVE-2021-23566: Information Exposure
A flaw was found in the nanoid library where the valueOf() function allows the reproduction of the last id generated. This flaw allows an attacker to expose sensitive information.
Other sources
The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/nanoidto a version that resolves this vulnerability.Fixed in 3.1.31 - Upgrade
Upgrade
redhat/nanoidto a version that resolves this vulnerability.Fixed in 3.1.31
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2021-23566?
CVE-2021-23566 has been rated as a medium severity vulnerability due to its potential for information exposure.
How do I fix CVE-2021-23566?
To fix CVE-2021-23566, you should upgrade the nanoid library to version 3.1.31 or later.
What versions are affected by CVE-2021-23566?
CVE-2021-23566 affects the nanoid library from version 3.0.0 up to, but not including, version 3.1.31.
What type of vulnerability is CVE-2021-23566?
CVE-2021-23566 is categorized as an information exposure vulnerability.
What impact does CVE-2021-23566 have on applications?
CVE-2021-23566 can allow attackers to reproduce the last ID generated, potentially exposing sensitive information.