Junglewise Threat Intelligence

CVE-2026-67214: nanoid infinite loop in non-secure module

CVE-2026-67214 · Severity: medium · CVSS 5.9 · Published 2026-07-29

Technologies: Ai Nanoid.

Executive brief

Nano ID is a popular JavaScript library for generating unique, URL-friendly IDs. The non-secure module contains a flaw where passing a negative size value to the nanoid() or customAlphabet() functions causes an infinite loop that consumes memory until the process crashes. An attacker who can control the size parameter passed to these functions can trigger a denial-of-service condition, halting the application.

Technical details

The vulnerability is a classic infinite loop (CWE-835) in the non-secure module of nanoid. The affected functions use a while loop with the pattern `let i = size | 0; while (i--)`, which truncates fractional sizes but fails to guard against negative values. When size is negative, the counter i decrements toward the minimum 32-bit integer without ever reaching zero, causing an infinite loop that blocks the event loop and consumes heap memory until out-of-memory (OOM) termination. The attack requires the attacker to control the size parameter passed to nanoid() or customAlphabet(), a precondition that depends on the application's input validation. The secure module already contains proper guards, but this flaw was overlooked in the non-secure variant. Patches were released in version 5.1.16 (main branch, June 2026) and version 3.3.16 (v3 branch, July 2026) by implementing a guard condition `while (i-- > 0)` to clamp the loop to non-negative iterations.

Affected products

  • ai nanoid before 3.3.16 and before 5.1.16

Timeline

  • 2026-07-29: disclosed
  • 2026-06-24: patched: version 5.1.16 released on main branch
  • 2026-07-12: patched: version 3.3.16 released on v3 branch

References

Related threats