CVE-2026-67214 in nanoid
Summary
by MITRE • 07/29/2026
nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The vulnerability in nanoid versions prior to 5.1.16 represents a critical denial-of-service weakness that stems from improper input validation within the non-secure module implementation. This flaw manifests specifically in the customAlphabet and nanoid functions where the internal loop logic fails to properly handle negative size parameters, creating an infinite loop condition that consumes system resources indefinitely. The issue occurs because the loop counter is decremented from a negative initial value without proper boundary checks, causing the termination condition to never be met.
The technical implementation of this vulnerability follows a classic control flow flaw pattern where the absence of input validation creates a path for malicious execution. When an attacker provides a negative size parameter to either function, the internal loop structure begins with a negative counter value and decrements it without proper bounds checking. This creates a scenario where the loop condition can never be satisfied, resulting in continuous execution that blocks the calling thread and prevents further processing. The vulnerability is particularly concerning because it affects the non-secure module which may be used in applications where performance optimization is prioritized over security validation.
From an operational standpoint, this vulnerability exposes applications to significant risks when they rely on user-provided input without proper sanitization. Applications that accept size parameters from external sources and pass them directly to nanoid functions become susceptible to resource exhaustion attacks, potentially leading to complete system unresponsiveness. The impact extends beyond individual function calls to affect entire application threads, making this a severe threat in multi-threaded environments where resource contention can cascade into broader system failures.
The vulnerability aligns with CWE-835 which specifically addresses infinite loops and the potential for denial-of-service conditions caused by improper loop termination. It also maps to ATT&CK technique T1499.004 which covers network denial of service attacks through resource exhaustion. Organizations using affected versions should prioritize immediate patching to address this vulnerability, as it represents a straightforward path for attackers to consume system resources and potentially disrupt service availability.
Mitigation strategies should focus on implementing proper input validation at all levels where user-provided parameters interact with the nanoid library functions. Applications should validate that size parameters are positive integers before passing them to these functions, while also considering the implementation of timeout mechanisms or resource limits to prevent complete system hangs. The fix in version 5.1.16 addresses this by adding proper boundary checks that ensure loop termination conditions are always met regardless of input values, preventing the infinite execution path that previously existed.