CVE-2024-55565

A flaw was found in nanoid. Affected versions of nanoid mishandles non-integer values. When nanoid is called with a fractional value, there were a number of undesirable effects:

• In browser and non-secure, the code infinite loops on while (size--)
• In node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled: when i is initialized to poolOffset, pool[i] & 63 -> undefined & 63 -> 0
• If the first call in node is a fractional argument, the initial buffer allocation fails with an error

The highest impact of this issue system availability.

Moderate impact: CVE-2024-55565 affects Red Hat products and components that ship nanoid in the current affected mappings. When nanoid is called with a fractional size, browser and non-secure implementations can enter an infinite loop; in Node.js, calls can return zeroes until the pool is refilled, and an initial fractional call can fail buffer allocation. These behaviors can impair system availability. Red Hat rates the issue Moderate (CVSS 6.5, CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The current scope spans Red Hat middleware, Ansible, OpenShift, cloud services, Enterprise Linux, and Ceph mappings, as well as Community Projects: 196 of 198 mappings are marked AFFECTED and two are NEW/OOSS. Delegated handling includes affected, WONTFIX, OOSS, DEFER, and NOTAFFECTED outcomes. For delegated mappings marked AFFECTED, a fix is being pursued. For DEFER mappings, the record does not state why remediation is deferred; the residual risk is continued availability or functional impact if fractional values reach nanoid. Mappings delegated as NOTAFFECTED are product-specific determinations, but the record provides no technical rationale for them. The Red Hat assessment is higher than the external CISA score (6.5 versus 4.3), reflecting different assumptions about required privileges and affected security properties.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.