Executive brief
nanoid is a widely-used JavaScript library for generating unique identifiers used in web applications and services. When the library is called with non-integer size values, it causes severe degradation: applications may hang in infinite loops (browser environments), return only zeros (Node.js), or crash during initialization. An attacker or buggy code can trigger this by passing fractional values, disrupting application availability.
Technical details
The vulnerability is an input validation flaw (CWE-835, infinite loop) in nanoid's size parameter handling. When nanoid is called with a fractional value instead of an integer: in browser/non-secure environments, the while(size--) loop never terminates; in Node.js, poolOffset becomes fractional, causing arithmetic operations to yield undefined values (pool[i] & 63 → undefined & 63 → 0), resulting in only zeros being returned; in some cases, initial buffer allocation fails entirely. The attack vector is local/same-origin (requires calling code to pass fractional size), with no authentication or network requirement. Fix is available in nanoid v3.3.8 and v5.0.9 with explicit integer casting (|0 operator) added to the size parameter.
Affected products
- ai nanoid 0 to 3.3.7; 4.0.0 to 5.0.8
Timeline
- 2024-12-09: disclosed
- 2024-11-26: patched: Fix merged in PR #510; releases 3.3.8 and 5.0.9