DEBIAN-CVE-2026-67214
- Source
- https://security-tracker.debian.org/tracker/CVE-2026-67214
- Import Source
- https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-67214.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-67214
- Upstream
- Published
- 2026-07-29T14:16:35Z
- Modified
- 2026-09-01T16:06:57Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
- Summary
- [none]
- Details
-
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
- References
Affected packages
Debian:12
node-mocha
Package
- Name
- node-mocha
- Purl
- pkg:deb/debian/node-mocha?arch=source&distro=bookworm
node-postcss
Package
- Name
- node-postcss
- Purl
- pkg:deb/debian/node-postcss?arch=source&distro=bookworm
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Affected versions
8.*
8.4.20+~cs8.0.23-1
8.4.20+~cs8.0.23-1+deb12u1
8.4.31+~cs8.0.26-1
8.4.39+~cs9.2.29-1
8.4.49+~cs9.2.32-1
8.5.6+~cs9.3.28-1
8.5.8+~cs9.3.30-1
8.5.9+~cs9.3.30-1
8.5.12+~cs9.3.32-1
8.5.14+~cs9.3.34-1
8.5.15+~cs9.3.34-1
8.5.15+~cs9.3.38-1
8.5.15+~cs9.3.39-1
8.5.19+~cs10.2.23-1
8.5.21+~cs10.2.23-1
8.5.23+~cs10.2.23-1
8.5.25+~cs10.2.23-1
8.5.26+~cs10.2.24-1
Debian:13
node-mocha
Package
- Name
- node-mocha
- Purl
- pkg:deb/debian/node-mocha?arch=source&distro=trixie
node-postcss
Package
- Name
- node-postcss
- Purl
- pkg:deb/debian/node-postcss?arch=source&distro=trixie
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affected
Debian:14
node-mocha
Package
- Name
- node-mocha
- Purl
- pkg:deb/debian/node-mocha?arch=source&distro=forky
node-postcss
Package
- Name
- node-postcss
- Purl
- pkg:deb/debian/node-postcss?arch=source&distro=forky
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0 Unknown introduced version / All previous versions are affectedFixed8.5.15+~cs9.3.39-1