nanoid EUVD-2026-50325

Vendor-released patch: upgrade to nanoid 5.1.6 or later, which fixes the infinite loop on a 0 size for customAlphabet (fix commit cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7; release https://github.com/ai/nanoid/releases/tag/5.1.6); run npm/yarn/pnpm update and rebuild lockfiles, and check transitive dependencies with npm ls nanoid since it is frequently pulled in indirectly. If you cannot upgrade immediately, the effective compensating control is input validation at the call site: reject or clamp any size value that is not a positive integer before passing it to customAlphabet/customRandom (e.g. enforce size >= 1), which fully neutralizes the trigger with no functional side effect for legitimate callers. Where the size is derived from user input such as a query parameter or request body, add server-side bounds checking and treat 0 as invalid; the only trade-off is that requests explicitly asking for a zero-length ID are rejected rather than served, which is the correct behavior anyway. Consult the VulnCheck advisory (https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom) for details.