CVE-2026-67213

A flaw was found in nanoid (Nano ID), a small, secure, and URL-friendly unique string ID generator. An attacker could exploit this vulnerability by providing a zero-size input to the customAlphabet or customRandom functions. This would cause an infinite loop, leading to a denial of service (DoS) condition by hanging the application's calling thread.

An algorithmic denial of service flaw was found in the nanoid library. When calling customAlphabet or customRandom with a size parameter of 0, the internal generation loop fails to meet its termination condition. In Node.js or browser execution contexts, an attacker who supplies an unvalidated, zero-value size parameter to these functions causes the thread to enter an infinite loop, driving CPU utilization to 100% and completely blocking event loop execution for that thread.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, ensure application code validates the size parameter passed to customAlphabet or customRandom, rejecting or sanitizing zero-value inputs before passing them to nanoid.