CVE-2026-67214: nanoid infinite loop in non-secure module

CVE-2026-67214 · Severity: medium · CVSS 5.9 · Published 2026-07-29

Nano ID is a popular JavaScript library for generating unique, URL-friendly IDs. The non-secure module contains a flaw where passing a negative size value to the nanoid() or customAlphabet() functions causes an infinite loop that consumes memory until the process crashes. An attacker who can control the size parameter passed to these functions can trigger a denial-of-service condition, halting the application.

Technologies: nanoid (npm). Vendors: npm.

Quick answers

Is CVE-2026-67214 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-67214 being exploited in the wild.
How severe is CVE-2026-67214?
Medium severity, with a CVSS score of 5.9, published 29 July 2026.
Which products and versions are affected?
Nano ID Project Nano ID < 5.1.16; nanoid (npm) SEMVER:introduced=0,fixed=3.3.16.
Is there a fix for CVE-2026-67214?
Yes. nanoid (npm): upgrade to 3.3.16 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-67214 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-67214?
Check whether you run Nano ID Project Nano ID or nanoid (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • nanoid (npm): upgrade to 3.3.16 or later
    npm install nanoid@3.3.16

Technical details

The vulnerability is a classic infinite loop (CWE-835) in the non-secure module of nanoid. The affected functions use a while loop with the pattern `let i = size | 0; while (i--)`, which truncates fractional sizes but fails to guard against negative values. When size is negative, the counter i decrements toward the minimum 32-bit integer without ever reaching zero, causing an infinite loop that blocks the event loop and consumes heap memory until out-of-memory (OOM) termination. The attack requires the attacker to control the size parameter passed to nanoid() or customAlphabet(), a precondition that depends on the application's input validation. The secure module already contains proper guards, but this flaw was overlooked in the non-secure variant. Patches were released in version 5.1.16 (main branch, June 2026) and version 3.3.16 (v3 branch, July 2026) by implementing a guard condition `while (i-- > 0)` to clamp the loop to non-negative iterations.

Affected products

  • ai nanoid before 3.3.16 and before 5.1.16

Identifiers

  • CVE-2026-67214
  • GHSA-28wg-ghj8-5hjv

Timeline

  • 2026-07-29: disclosed
  • 2026-06-24: patched: version 5.1.16 released on main branch
  • 2026-07-12: patched: version 3.3.16 released on v3 branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.