nanoid CVE-2026-73086

Exploitation requires that attacker-controlled or attacker-influenced input reaches the size parameter of a nanoid(size) call without prior numeric validation - for example, an API that accepts a requested ID or token length and forwards it directly to the library. The CVSS AC:H metric captures this precondition explicitly. Applications that call nanoid() with no argument (using the default size of 21) or with a hardcoded size constant are not exploitable through this vector, as the overflow-triggering value 2147483648 must be passed at runtime. Once triggered, no further attacker interaction is required; the pool corruption is immediate and process-wide, persisting silently until the process is restarted. Authentication is not required to trigger the flaw if the vulnerable size parameter is reachable via an unauthenticated endpoint; the CVSS PR:N vector confirms this. Exploitation is limited to environments where nanoid is used with a caller-supplied size and where that size originates from an untrusted source such as user request parameters, external configuration, or a dependency chain that does not enforce bounds.

The CVSS 7.4 score and vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N accurately models this flaw. The AC:H rating is the pivotal signal: exploitation is gated on attacker-controlled input reaching the size argument of a nanoid() call without prior bounds validation, which is a realistic but non-universal code pattern. When that precondition is satisfied, the impact is severe - confidentiality and integrity both collapse because every security token produced by the running process becomes guessable for an indefinite window, with no error surfaced to the application. Even a mid-sized municipal IT team in gdynia running a Node.js service that exposes a configurable token-length parameter would face complete session-compromise from a single poisoning request, with no log evidence of the attack. No EPSS score was provided in the input data, and CISA KEV listing is absent, indicating limited observed exploitation at time of analysis; however, the attack mechanism is fully documented in the public GitHub security advisory GHSA-xwg4-73v4-xw9w, lowering the barrier to exploitation once a vulnerable code path is identified. The silent-failure nature - the process continues running and returning tokens without any exception - makes this more dangerous than a crash-causing bug, as defenders have no automatic signal to investigate.

An attacker discovers an API endpoint that accepts a user-supplied token-length parameter and passes it without validation to nanoid(size) - for example, a 'generate API key of length N' feature. The attacker sends a single request with the value 2147483648, which the library coerces to -2147483648, silently zeroing the CSPRNG pool request and corrupting the global poolOffset. From that point forward, every session token, CSRF token, and API key issued by the process resolves to the fixed string 'uuuuuuuuuuuuuuuuuuuuu', allowing the attacker to authenticate as any user, bypass CSRF protections, or forge API credentials by presenting that predictable value.