CVE-2021-23566: Information Exposure in nanoid
Summary
CVE-2021-23566: Exposure of Sensitive Information to an Unauthorized Actor in nanoid. Affects nanoid versions >= 3.0.0, < 3.1.31. Fixed in 3.1.31. How to fix ↓
Also tracked for
- node-mocha · Debian:11
The same CVE-2021-23566 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nanoid is an npm package that generates unique IDs based on the URL-safe characters. It is commonly used in web applications to generate short, random, and unique identifiers. The package provides a valueOf() function that allows reproducing the last generated ID. However, versions 3.0.0 to 3.1.30 of nanoid are vulnerable to an information exposure issue through the valueOf() function.
Vulnerability Detail
The vulnerability in nanoid arises from the valueOf() function, which can be used to retrieve the last generated ID. This function can be accessed by an unauthorized actor, potentially exposing sensitive information. The impact of this vulnerability depends on the context in which nanoid is used. If the generated IDs are used to represent sensitive data or grant access to resources, an attacker could exploit this vulnerability to gain unauthorized access or obtain sensitive information.
How To Fix
Latest published version: 6.0.2 as of 22 Oct 2026
npm install nanoid@6.0.2Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.1.31
This is the first release that contains the fix.
npm install nanoid@3.1.31Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, developers can avoid using the valueOf() function in their code. By not relying on this function, the risk of information exposure is mitigated. Here's an example of how to generate IDs without using valueOf():
const nanoid = require('nanoid');
const id = nanoid();
console.log(id);
Conclusion
nanoid versions 3.0.0 to 3.1.30 are vulnerable to an information exposure issue through the valueOf() function. Developers should update to version 3.1.31 or later to fix this vulnerability. It is recommended to avoid using the valueOf() function as a workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for nanoid →
FAQ
nanoid is an npm package used to generate unique and random IDs.
The vulnerability in nanoid allows an unauthorized actor to access the last generated ID, potentially exposing sensitive information.
The impact depends on the context in which nanoid is used. If the generated IDs are used to represent sensitive data or grant access to resources, an attacker could gain unauthorized access or obtain sensitive information.
To fix this vulnerability, update nanoid to version 3.1.31 or later using the command 'npm install nanoid@latest'.
Yes, developers can avoid using the valueOf() function in their code to mitigate the risk of information exposure.
References
Related vulnerabilities
Recent vulnerabilities recorded for nanoid.
