CVE-2021-23566

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

References

Affected packages

Git / github.com/ai/nanoid

Affected ranges

Type

GIT

Repo

https://github.com/ai/nanoid

Events

Introduced

7b45b890ce9cba85c8dc08fdb7ad401b966ed067

Fixed

07fdfa6618e2668ce51b2554ee3e1a3ad87b0492

Fixed

2b7bd9332bc49b6330c7ddb08e5c661833db2575

Database specific

{
    "cpe": "cpe:2.3:a:nanoid_project:nanoid:*:*:*:*:*:node.js:*:*",
    "extracted_events": [
        {
            "introduced": "3.0.0"
        },
        {
            "fixed": "3.1.31"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

3.*

3.0.0

3.0.1

3.0.2

3.1.0

3.1.1

3.1.10

3.1.11

3.1.12

3.1.13

3.1.14

3.1.15

3.1.16

3.1.17

3.1.18

3.1.19

3.1.2

3.1.20

3.1.21

3.1.22

3.1.23

3.1.24

3.1.25

3.1.26

3.1.27

3.1.28

3.1.29

3.1.30

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-23566.json"