CVE-2026-67213

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-67213
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-67213.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-67213
Aliases
Downstream
CGA (190)
CLEANSTART (36)
CLSA (1)
DEBIAN (1)
ECHO (1)
MINI (20)
RHSA (3)
ROOT (1)
UBUNTU (1)
Published
2026-07-29T13:32:01Z
Modified
2026-10-16T03:00:13Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
nanoid before 5.1.6 Infinite Loop via Zero Size in customAlphabet and customRandom
Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-835"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67213.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "introduced": "3.0.0"
                        },
                        {
                            "fixed": "3.3.17"
                        },
                        {
                            "introduced": "5.0.0"
                        },
                        {
                            "fixed": "5.1.6"
                        }
                    ],
                    "source": "AFFECTED_FIELD",
                    "strategy": "StandardRange"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "5.1.6"
                        }
                    ],
                    "source": "CPE_FIELD",
                    "strategy": "CPEApplicability"
                }
            ]
        },
        {
            "extracted_events": [
                {
                    "range": [
                        {
                            "fixed": "5.1.6"
                        }
                    ],
                    "source": "DESCRIPTION"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/ai/nanoid

Affected ranges

Type
GIT
Repo
https://github.com/ai/nanoid
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
c6532dba6f3954b683bd77c71b352c1ee0ed9961
Fixed
cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
Database specific
Show details 
{
    "extracted_events": [
        {
            "original_tag": "5.1.6",
            "range": [
                {
                    "fixed": "c6532dba6f3954b683bd77c71b352c1ee0ed9961"
                }
            ],
            "source": "REFERENCES_TAG"
        },
        {
            "range": [
                {
                    "fixed": "cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

0.*
0.1.0
0.1.1
0.2.0
0.2.1
0.2.2
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.1.0
1.1.1
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
2.*
2.0.0
2.0.1
2.0.2
2.0.3
2.0.4
2.1.0
2.1.1
2.1.10
2.1.11
2.1.2
2.1.3
2.1.4
2.1.5
2.1.6
2.1.7
2.1.8
2.1.9
3.*
3.0.0
3.0.1
3.0.2
3.1.0
3.1.1
3.1.10
3.1.11
3.1.12
3.1.13
3.1.14
3.1.15
3.1.16
3.1.17
3.1.18
3.1.19
3.1.2
3.1.20
3.1.21
3.1.22
3.1.23
3.1.24
3.1.25
3.1.26
3.1.27
3.1.28
3.1.29
3.1.30
3.1.31
3.1.32
3.1.4
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.2.0
3.3.0
3.3.1
3.3.2
3.3.3
3.3.4
4.*
4.0.0
4.0.1
4.0.2
5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.0.5
5.0.6
5.0.7
5.0.8
5.0.9
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.1.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-67213.json"