CVE-2026-67213: nanoid Package Infinite Loop Vulnerability Due to Zero Size Input
Summary
CVE-2026-67213: nanoid: custom generators can loop indefinitely when size is zero. Affects nanoid across 2 version ranges.
< 3.3.17
>= 4.0.0, < 5.1.6
Fixed in 3.3.17 or 5.1.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
nanoid is a popular library used for generating unique IDs in JavaScript applications. It is known for its efficiency and small size, making it a preferred choice for developers needing unique identifiers. However, a critical vulnerability has been identified in versions prior to 5.1.6, where custom generators can enter an infinite loop if a size of zero is provided, leading to potential denial-of-service conditions.
Vulnerability Detail
The vulnerability arises from the customAlphabet and customRandom functions in the nanoid package, which do not handle a size of zero correctly. When these functions are called with an unvalidated size of zero, they enter an infinite loop, causing the application to hang indefinitely. This can be exploited by an attacker to create a denial-of-service condition, affecting the availability of the application.
How To Fix
Latest published version: 6.0.2 as of 22 Oct 2026
npm install nanoid@6.0.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.3.173.3.17npm install nanoid@3.3.17 -
>= 4.0.0, < 5.1.65.1.6npm install nanoid@5.1.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that any input to the customAlphabet and customRandom functions is validated to prevent a size of zero from being passed. For example, you can implement a check like this: if (size <= 0) { throw new
Error('Size must be greater than zero');
}
Conclusion
The nanoid package has a critical vulnerability that can lead to denial-of-service conditions if a size of zero is passed to its custom generators. It is essential to update to version 5.1.6 or later to mitigate this risk. Additionally, implementing input validation can serve as a temporary workaround while you prepare for the update.
See every vulnerability recorded for nanoid →
FAQ
The CVSS score of this vulnerability is 5.9, indicating a medium severity level.
Versions of nanoid prior to 5.1.6 are affected by this vulnerability.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package immediately, implement input validation to prevent a size of zero from being passed to the customAlphabet and customRandom functions.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
References
Related vulnerabilities
Recent vulnerabilities recorded for nanoid.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
