CVE-2026-67214

A flaw was found in nanoid (Nano ID), a JavaScript library used for generating unique identifiers. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a negative size is provided, these functions enter an infinite loop, causing the application to hang indefinitely and disrupting service availability.

An input validation flaw in Nano ID's non-secure module (nanoid/non-secure) causes an infinite loop in the customAlphabet and nanoid functions when processed with a negative size parameter. Because the decrementing loop counter never meets its termination condition, an unauthenticated attacker who passes an unvalidated negative integer value can block the NodeJS event loop, resulting in a thread hang and complete Denial of Service (DoS) for the host application.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Sanitize all user-supplied integer inputs before passing them to nanoid or customAlphabet functions in the nanoid/non-secure module, ensuring the size parameter is strictly a non-negative integer.