CVE-2026-67214Medium· 5.9▾ Sunlitnanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 32.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
nanoid < 3.3.16nanoid >= 4.0.0, < 5.1.16Upgrade past the affected range:
nanoid 5.1.16Connected by shared product, vendor, weakness, or advisory.
CVE-2026-56852High· 7.5Infinite loop on invalid input in golang.org/x/text
CVE-2026-67213Medium· 5.9nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions
CVE-2026-46385High· 7.5iskorotkov/avro is a fast Go Avro codec
CVE-2026-59879Medium· 5.3immutable-js: Immutable.js: Denial of Service due to mishandling of large index values in List operations (CVE-2026-59879)
CVE-2026-59874High· 7.5tar: Node-tar: Denial of Service via malformed tar archive header (CVE-2026-59874)
CVE-2026-59877High· 7.5protobufjs: protobufjs: Denial of Service via crafted .proto schema (CVE-2026-59877)