CVE-2026-73086: nanoid Integer Overflow Vulnerability Leading to Predictable ID Generation
Summary
CVE-2026-73086: nanoid: Integer Overflow or Wraparound. Affects nanoid across 2 version ranges.
< 3.3.12
>= 4.0.0, < 5.1.11
Fixed in 3.3.12 or 5.1.11, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
nanoid is a popular library used for generating unique IDs in JavaScript applications. It is known for its performance and cryptographic security, making it suitable for session tokens, CSRF tokens, and unique identifiers. However, a critical vulnerability has been identified that compromises its randomness guarantees when user-influenced values are passed to the size parameter.
Vulnerability Detail
The vulnerability arises from an integer overflow in the nanoid(size) function. When the size parameter is coerced to a signed 32-bit integer, values greater than or equal to 2^31 (e.g., 2147483648) wrap around to a negative value (-2147483648). This negative value is then used in the fillPool function, which leads to a persistent corruption of the process-wide cryptographically secure random number generator (CSPRNG) pool. As a result, all subsequent ID generations return the deterministic string 'uuuuuuuuuuuuuuuuuuuuu', causing a complete loss of unpredictability and uniqueness for session IDs, CSRF tokens, and other identifiers. This vulnerability can be exploited by any unauthenticated user who can influence the size parameter, leading to potential session hijacking and authentication bypass.
How To Fix
Latest published version: 6.0.2 as of 22 Oct 2026
npm install nanoid@6.0.2Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 3.3.123.3.12npm install nanoid@3.3.12 -
>= 4.0.0, < 5.1.115.1.11npm install nanoid@5.1.11
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, validate the size parameter before passing it to the nanoid function to ensure it does not exceed a safe limit. For example:
const safeSize = Math.min(size, 100); // Limit size to a maximum of 100
const id = nanoid(safeSize);
Conclusion
The nanoid library has a critical vulnerability (CVE-2026-73086) that can lead to predictable ID generation due to an integer overflow. It is essential to update to the latest patched versions to mitigate this risk. Implementing input validation can serve as a temporary workaround until the update is applied.
See every vulnerability recorded for nanoid →
FAQ
The CVSS score of this vulnerability is 7.4, indicating a high severity level.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json. You can also check your application using the Vulert playground without signup.
The vulnerability can lead to predictable session IDs and tokens, enabling attackers to hijack sessions and bypass authentication.
Yes, you should use nanoid version 3.3.12 or later for 3.x users, and version 5.1.11 or later for 4.x users to avoid this vulnerability.
If immediate updates are not possible, implement input validation on the size parameter to prevent values that could trigger the overflow.
References
Related vulnerabilities
Recent vulnerabilities recorded for nanoid.
