CVE-2026-67213: nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nanoid (Nano ID)to a version that resolves this vulnerability.Fixed in 5.1.6 - Configuration
Ensure the attacker-controlled size passed to nanoid customAlphabet and customRandom is never configured as 0; reject/validate size inputs to be greater than 0 to avoid the infinite generation loop that hangs the calling thread (vulnerable in versions before 5.1.6).
nanoid (Nano ID) customAlphabet/customRandom size parameter = must be > 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67213?
The severity of CVE-2026-67213 is classified as medium with a score of 5.9.
How do I fix CVE-2026-67213?
To fix CVE-2026-67213, upgrade nanoid to version 5.1.6 or later.
What impact does CVE-2026-67213 have on applications?
CVE-2026-67213 can cause applications to hang indefinitely when using the customAlphabet and customRandom functions with a size of 0.
What functions are affected by CVE-2026-67213?
CVE-2026-67213 impacts the customAlphabet and customRandom functions in nanoid versions prior to 5.1.6.
When was CVE-2026-67213 published?
CVE-2026-67213 was published on July 29, 2026.