CVE-2026-67214: nanoid Infinite Loop via Negative Size in non-secure module
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/node-mochato a version that resolves this vulnerability.Fixed in 9.1.4+ds1+~cs28.2.8-1 - Upgrade
Upgrade
debian/node-postcssto a version that resolves this vulnerability.Fixed in 8.5.15+~cs9.3.39-1 - Upgrade
Upgrade
debian/node-mochato a version that resolves this vulnerability.Fixed in 10.1.0+ds1+~cs29.3.1-1Fixed in 10.7.2+ds1+~cs33.1.11-2Fixed in 12.0.3+~cs20.0.13-3 - Upgrade
Upgrade
debian/node-postcssto a version that resolves this vulnerability.Fixed in 8.5.31+~cs10.2.26-1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-67214?
The severity of CVE-2026-67214 is medium with a score of 5.9.
How does CVE-2026-67214 affect nanoid before version 5.1.16?
CVE-2026-67214 causes an infinite loop when the customAlphabet and nanoid functions are provided a negative size in the non-secure module.
How can I fix CVE-2026-67214?
To fix CVE-2026-67214, update nanoid to version 5.1.16 or later.
What types of applications are vulnerable to CVE-2026-67214?
Any application using nanoid before version 5.1.16 that calls customAlphabet or nanoid with a negative size is vulnerable to CVE-2026-67214.
What module is affected by CVE-2026-67214 in nanoid?
CVE-2026-67214 specifically affects the non-secure module of nanoid.