CVE-2021-23566

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

References

Affected packages

Git / github.com/ai/nanoid

Affected ranges

Type: GIT
Repo: https://github.com/ai/nanoid
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

2b7bd9332bc49b6330c7ddb08e5c661833db2575

Affected versions

0.*

0.1.0

0.1.1

0.2.0

0.2.1

0.2.2

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.1.0

1.1.1

1.2.0

1.2.1

1.2.2

1.2.3

1.2.4

1.2.5

1.2.6

1.3.0

1.3.1

1.3.2

1.3.3

1.3.4

2.*

2.0.0

2.0.1

2.0.2

2.0.3

2.0.4

2.1.0

2.1.1

2.1.10

2.1.11

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

3.*

3.0.0

3.0.1

3.0.2

3.1.0

3.1.1

3.1.10

3.1.11

3.1.12

3.1.13

3.1.14

3.1.15

3.1.16

3.1.17

3.1.18

3.1.19

3.1.2

3.1.20

3.1.21

3.1.22

3.1.23

3.1.24

3.1.25

3.1.26

3.1.27

3.1.28

3.1.29

3.1.30

3.1.4

3.1.5

3.1.6

3.1.7

3.1.8

3.1.9

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-23566.json"