CVE-2026-67213 in nanoid
Summary
by MITRE • 07/29/2026
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The nanoid library represents a widely adopted secure random string generator used across numerous applications for creating unique identifiers, tokens, and session keys. This vulnerability affects versions prior to 5.1.6 and specifically targets two core functions: customAlphabet and customRandom. The flaw manifests when these functions receive a size parameter set to zero, which creates a critical logical error in the internal loop structure. The implementation fails to properly validate input parameters before entering the generation cycle, resulting in an infinite loop condition that consumes CPU resources indefinitely.
The technical nature of this vulnerability stems from inadequate boundary checking within the library's core generation algorithms. When size equals zero, the loop condition designed to terminate the random character generation process never becomes false, causing the thread to spin continuously without yielding control back to the operating system. This behavior constitutes a classic denial-of-service attack vector that can be exploited by malicious actors who control input parameters passed to these functions. The vulnerability specifically aligns with CWE-835, which addresses infinite loops or iterations in software implementations, and represents a failure in proper input validation and error handling mechanisms.
The operational impact of this vulnerability extends beyond simple resource exhaustion, as it can effectively瘫痪 entire applications or services that rely on nanoid for critical operations. When an attacker successfully injects a zero size parameter through unvalidated user input, the calling thread becomes trapped in the infinite loop, potentially causing cascading failures throughout the application's execution flow. This scenario particularly affects web applications where user-supplied parameters might be passed directly to these functions without proper sanitization or validation checks. The vulnerability can be exploited in various contexts including API endpoints, form processing, and configuration management systems where identifiers are dynamically generated.
Mitigation strategies should focus on immediate version upgrades to nanoid 5.1.6 or later, which contain the necessary patch to prevent infinite loop conditions. Additionally, applications should implement comprehensive input validation routines that explicitly check for zero or negative size parameters before invoking these functions. Security teams must also consider implementing runtime monitoring to detect abnormal CPU usage patterns that could indicate exploitation attempts. The fix addresses the underlying issue by introducing proper boundary conditions in the loop control structures, ensuring that even when zero values are passed, the generation process terminates gracefully with appropriate error handling rather than entering an infinite execution cycle. Organizations should conduct thorough code reviews to identify all potential injection points where user input might reach these functions and establish automated testing procedures to verify parameter validation behaviors across their application portfolios.