--- id: CVE-2026-67214 title: >- nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure) summary: >- nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented … severity: medium cvss: 5.9 cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-835 - CWE-839 vendor: nanoid_project product: nanoid affected: - nanoid < 3.3.16 - 'nanoid >= 4.0.0, < 5.1.16' patched: - nanoid 5.1.16 published: '2026-07-29' updated: '2026-10-08' sourceUpdated: '2026-10-08T16:17:30.523' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67214' references: - url: >- https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49 label: disclosure@vulncheck.com - url: 'https://github.com/ai/nanoid/releases/tag/3.3.16' label: disclosure@vulncheck.com - url: 'https://github.com/ai/nanoid/releases/tag/5.1.16' label: disclosure@vulncheck.com - url: >- https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module label: disclosure@vulncheck.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67214.json - url: 'https://access.redhat.com/security/cve/CVE-2026-67214' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2508411' - url: 'https://www.cve.org/CVERecord?id=CVE-2026-67214' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67214' - url: 'https://access.redhat.com/errata/RHSA-2026:71113' - url: 'https://access.redhat.com/errata/RHSA-2026:60387' - url: 'https://access.redhat.com/errata/RHSA-2026:60390' - url: 'https://access.redhat.com/errata/RHSA-2026:60388' - url: 'https://access.redhat.com/errata/RHSA-2026:60386' - url: 'https://access.redhat.com/errata/RHSA-2026:65118' - url: 'https://access.redhat.com/errata/RHSA-2026:65155' - url: 'https://access.redhat.com/errata/RHSA-2026:69248' - url: 'https://access.redhat.com/errata/RHSA-2026:61783' - url: 'https://access.redhat.com/errata/RHSA-2026:48241' - url: 'https://access.redhat.com/errata/RHSA-2026:59030' - url: 'https://access.redhat.com/errata/RHSA-2026:48320' - url: 'https://access.redhat.com/errata/RHSA-2026:62260' - url: 'https://access.redhat.com/errata/RHSA-2026:66084' - url: 'https://access.redhat.com/errata/RHSA-2026:66523' - url: 'https://access.redhat.com/errata/RHSA-2026:70267' - url: 'https://access.redhat.com/errata/RHSA-2026:69255' - url: 'https://access.redhat.com/errata/RHSA-2026:65514' - url: 'https://access.redhat.com/errata/RHSA-2026:59593' - url: 'https://access.redhat.com/errata/RHSA-2026:59558' - url: 'https://access.redhat.com/errata/RHSA-2026:59559' - url: 'https://access.redhat.com/errata/RHSA-2026:74511' - url: 'https://access.redhat.com/errata/RHSA-2026:63307' - url: 'https://access.redhat.com/errata/RHSA-2026:79088' - url: 'https://access.redhat.com/errata/RHSA-2026:81110' tags: - nvd - cve.org - csaf - vex - red-hat ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-07-29T14:37:09.751333Z' epss: 0.0033 epssPercentile: 0.25965 scores: nvd: 5.9 vendor: 7.5 cna: 5.9 ingestedAt: '2026-09-30T17:13:20.782Z' --- ## Overview nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition. ## Affected - `nanoid < 3.3.16` - `nanoid >= 4.0.0, < 5.1.16` ## Remediation Upgrade past the affected range: - `nanoid 5.1.16` ## Vendor advisories - **RHSA-2026:71113** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.6 for RHEL 9 · released 2026-09-23 · [advisory](https://access.redhat.com/errata/RHSA-2026:71113) - **RHSA-2026:60387** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.11 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60387) - **RHSA-2026:60390** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.13 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60390) - **RHSA-2026:60388** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.14 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60388) - **RHSA-2026:60386** · Red Hat · fixed in: Red Hat Advanced Cluster Management for Kubernetes 2.17 · released 2026-08-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:60386) - **RHSA-2026:65118** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.1 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65118) - **RHSA-2026:65155** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.2 · released 2026-09-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:65155) - **RHSA-2026:69248** · Red Hat · fixed in: Red Hat Developer Hub 1.9 · released 2026-09-21 · [advisory](https://access.redhat.com/errata/RHSA-2026:69248) - **RHSA-2026:61783** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:61783) - **RHSA-2026:48241** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:48241) - **RHSA-2026:59030** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-08-24 · [advisory](https://access.redhat.com/errata/RHSA-2026:59030) - **Red Hat VEX** · Important · affected: Migration Toolkit for Containers, Node HealthCheck Operator, OpenShift Lightspeed, OpenShift Pipelines, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 3, … · no fix planned: Migration Toolkit for Containers, Red Hat Ansible Automation Platform 2, Red Hat Fuse 7, Red Hat OpenShift GitOps, … · updated 2026-10-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-67214.json) - **RHSA-2026:79088** · Red Hat · fixed in: Red Hat Developer Hub 1.10 · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:79088)