REDHAT-BUG-2514175: CSRF

Q: Who is exposed to this issue?

Applications using affected nanoid versions are exposed if user-controlled input can reach the size argument of nanoid(size). The impact is especially significant where nanoid-generated values are used for session tokens, CSRF tokens, API keys, or other security-sensitive identifiers.

Q: What does an attacker need to do to trigger the issue?

An attacker needs to cause nanoid(size) to be called with a size value of 2147483648. This corrupts the process-wide CSPRNG pool offset, causing subsequent generated values to become a predictable string until the process restarts.

Q: How can I tell whether a running process has been affected?

Affected processes generate the deterministic value "uuuuuuuuuuuuuuuuuuuuu" for subsequent Nano ID output after the triggering call. The condition persists until that process is restarted.

Q: What should be done if patching cannot happen immediately?

Prevent untrusted input from controlling the nanoid size parameter, and ensure calls cannot use the triggering value. If compromise is suspected, restart affected processes and rotate any session tokens, CSRF tokens, API keys, or other identifiers generated after exploitation.

Q: Which versions contain the fix?

The issue is fixed in nanoid versions 3.3.12 and 5.1.11. Versions prior to those releases are affected.

Published Aug 11, 2026

Updated

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

Affected Software

2 affected components

npm/nanoid>0<=3.3.11

npm/nanoid>0<=5.1.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade nanoid to a version that resolves this vulnerability.
Fixed in 3.3.12
Upgrade
Upgrade nanoid to a version that resolves this vulnerability.
Fixed in 5.1.11
Operational
Restart the affected Node.js process after upgrading nanoid, because corrupted CSPRNG poolOffset in fillPool() can cause subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts.

Event History

Aug 11, 2026

Data Sourced

via Red Hat·05:12 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Who is exposed to this issue?

Applications using affected nanoid versions are exposed if user-controlled input can reach the size argument of nanoid(size). The impact is especially significant where nanoid-generated values are used for session tokens, CSRF tokens, API keys, or other security-sensitive identifiers.

What does an attacker need to do to trigger the issue?

An attacker needs to cause nanoid(size) to be called with a size value of 2147483648. This corrupts the process-wide CSPRNG pool offset, causing subsequent generated values to become a predictable string until the process restarts.

How can I tell whether a running process has been affected?

Affected processes generate the deterministic value "uuuuuuuuuuuuuuuuuuuuu" for subsequent Nano ID output after the triggering call. The condition persists until that process is restarted.

What should be done if patching cannot happen immediately?

Prevent untrusted input from controlling the nanoid size parameter, and ensure calls cannot use the triggering value. If compromise is suspected, restart affected processes and rotate any session tokens, CSRF tokens, API keys, or other identifiers generated after exploitation.

Which versions contain the fix?

The issue is fixed in nanoid versions 3.3.12 and 5.1.11. Versions prior to those releases are affected.

REDHAT-BUG-2514175: CSRF

Affected Software

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the issue?

How can I tell whether a running process has been affected?

What should be done if patching cannot happen immediately?

Which versions contain the fix?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to do to trigger the issue?

How can I tell whether a running process has been affected?

What should be done if patching cannot happen immediately?

Which versions contain the fix?