CVE-2026-73086: nanoid: Integer Overflow or Wraparound
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
nanoidto a version that resolves this vulnerability.Fixed in 3.3.12 - Upgrade
Upgrade
nanoidto a version that resolves this vulnerability.Fixed in 5.1.11 - Operational
After upgrading nanoid, restart the affected processes so the corrupted process-wide CSPRNG poolOffset in fillPool() is reset; otherwise subsequent session tokens, CSRF tokens, API keys, and unique identifiers may remain the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until restart.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-73086?
CVE-2026-73086 has a severity rating of high, with a score of 7.4.
What causes the vulnerability in CVE-2026-73086?
CVE-2026-73086 is caused by an integer overflow or wraparound in the nanoid(size) function that allows large size parameters to be misrepresented.
How do I fix CVE-2026-73086?
To fix CVE-2026-73086, update nanoid to version 3.3.12 or 5.1.11 or later.
Who is affected by CVE-2026-73086?
CVE-2026-73086 affects users of the nanoid library prior to versions 3.3.12 and 5.1.11.
What are the potential consequences of CVE-2026-73086?
The potential consequences of CVE-2026-73086 include corrupted unique string IDs and possible application logic errors.