REDHAT-BUG-2508406: High severity npm/nanoid vulnerability

Q: Which applications are realistically exposed to denial of service?

Applications using nanoid's customAlphabet or customRandom functions are exposed if they pass an attacker-controlled size value without validation and that value can be 0. The affected call hangs the calling thread indefinitely.

Q: Are normal Nano ID generation paths affected by this issue?

The issue is described specifically for customAlphabet and customRandom when configured with a size of 0. The provided information does not indicate that other generation paths are affected.

Q: What can be done if updating is not immediately possible?

Validate size values before calling customAlphabet or customRandom and reject or otherwise prevent a value of 0. Do not allow untrusted input to directly determine the requested size.

Q: How can teams determine whether they are affected?

Review uses of customAlphabet and customRandom and trace the source of their size argument. An application is affected if a caller can supply or cause a size of 0; versions before 5.1.6 are identified as containing the infinite loop.

Published Jul 29, 2026

Updated

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Affected Software

1 affected component

npm/nanoid<5.1.6

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade nanoid to a version that resolves this vulnerability.
Fixed in 5.1.6

Event History

Jul 29, 2026

Data Sourced

via Red Hat·02:01 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which applications are realistically exposed to denial of service?

Applications using nanoid's customAlphabet or customRandom functions are exposed if they pass an attacker-controlled size value without validation and that value can be 0. The affected call hangs the calling thread indefinitely.

Are normal Nano ID generation paths affected by this issue?

The issue is described specifically for customAlphabet and customRandom when configured with a size of 0. The provided information does not indicate that other generation paths are affected.

What can be done if updating is not immediately possible?

Validate size values before calling customAlphabet or customRandom and reject or otherwise prevent a value of 0. Do not allow untrusted input to directly determine the requested size.

How can teams determine whether they are affected?

Review uses of customAlphabet and customRandom and trace the source of their size argument. An application is affected if a caller can supply or cause a size of 0; versions before 5.1.6 are identified as containing the infinite loop.

REDHAT-BUG-2508406: High severity npm/nanoid vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which applications are realistically exposed to denial of service?

Are normal Nano ID generation paths affected by this issue?

What can be done if updating is not immediately possible?

How can teams determine whether they are affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to denial of service?

Are normal Nano ID generation paths affected by this issue?

What can be done if updating is not immediately possible?

How can teams determine whether they are affected?