What is the CVSS score of EUVD-2026-50326?

EUVD-2026-50326 has a CVSS 4.0 base score of 8.2 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.3%.

Is there a public PoC exploit available for EUVD-2026-50326?

Yes, a public proof-of-concept exploit is available for EUVD-2026-50326. Prioritise patching immediately. EPSS: 0.3%.

How to fix or mitigate EUVD-2026-50326?

Within 24 hours, audit your dependency tree and development pipeline to identify all applications using nanoid versions before 5.1.16 across development, staging, and production. Within 7 days, upgrade all affected instances to nanoid 5.1.16 or later, prioritizing production systems and customer-facing services first. Complete full testing and deployment of patched versions across all environments by day 30, ensuring no instances of vulnerable versions remain in active use.

nanoid EUVD-2026-50326

Q: Which versions of nanoid are affected by EUVD-2026-50326?

The nanoid JavaScript library versions prior to 5.1.16 contain a denial-of-service vulnerability that can hang application threads and block event loops, causing service disruptions for production…. A patch is available.

| CVE-2026-67214 HIGH

Loop with Unreachable Exit Condition (Infinite Loop) (CWE-835)

2026-07-29 VulnCheck

GHSA-28wg-ghj8-5hjv

Denial Of Service Nanoid

8.2

CVSS 4.0 · Vendor: VulnCheck

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Locate endpoint passing user input as nanoid size
Delivery

Submit request with negative size value
Exploit

Trigger infinite loop in nanoid/non-secure
Execution

Block event loop / spin CPU
Impact

Service denial for all clients

Vulnerability Assessment

Weakness	CWE CWE-835 ASVS 5.0 V15 - Secure Coding and Architecture Loop termination conditions MITRE ATT&CK 1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Requires that the target application call the customAlphabet or nanoid functions of the nanoid/non-secure module AND pass a negative, attacker-influenced value as the size/length argument without validation (this is the AT:P attack requirement). What limits exploitation: applications that use only fixed or server-controlled positive sizes, that validate input, or that use the default secure nanoid module are not exposed; there is no impact to confidentiality or integrity, and no authentication is inherently required by the library itself (PR:N), but reachability depends entirely on the host application exposing the size parameter to untrusted input.
Impact	Signals are mostly consistent toward a genuine but conditional availability risk. The CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H) scores 8.2 and correctly captures the key nuance via AT:P: exploitation carries an attack requirement - the host application must pass an unvalidated, attacker-controlled negative size into the vulnerable function; this is not exploitable against nanoid used with normal positive lengths. Impact is availability-only (no confidentiality or integrity impact). No EPSS score was supplied and there is no KEV listing or POC in the provided data, which argues against widespread opportunistic exploitation. The headline 8.2 should therefore be read as contingent on a specific insecure integration pattern rather than a universally remotely-triggerable DoS; conflict to note: raw score is High, but real-world exposure depends entirely on whether an application forwards user input as the size argument.
Exploit ScenarioDerived	An application uses nanoid/non-secure to generate an identifier whose length is taken from a user-supplied field (for example a query parameter or JSON body value) without validation. An unauthenticated attacker submits a request with that length set to a negative number, causing the worker thread/event loop to enter an infinite loop and stop serving other requests. No POC is included in the provided data, but the trigger is trivial once such an unvalidated code path exists.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

1 PoC candidate (unverified) Patch available 0.3% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 29, 2026

Denial-of-service in the nanoid JavaScript library (versions before 5.1.16) lets an attacker hang a Node.js/browser thread by supplying a negative size to the customAlphabet or nanoid functions of the non-secure module (nanoid/non-secure). Because the internal loop counter is decremented from a negative starting value, it never satisfies its termination condition and spins forever, consuming CPU and blocking the event loop. Reported by VulnCheck with a patch shipped in 5.1.16; no public exploit identified at time of analysis and it is not listed in CISA KEV.

RemediationAI

Vendor-released patch: 5.1.16 - upgrade the nanoid dependency to 5.1.16 or later (fix commit https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49, release https://github.com/ai/nanoid/releases/tag/5.1.16), and update transitive copies pulled in by other packages via a lockfile refresh or a package-manager override/resolution. As a compensating control until upgrade, validate and clamp the size argument before calling customAlphabet/nanoid - reject non-integer or negative values and enforce a sane maximum - so that no attacker-controlled value reaches the loop; this has negligible side effects since negative lengths are never legitimate. Where feasible, prefer the default secure nanoid entry point over nanoid/non-secure, noting the secure module is slightly slower and requires a crypto source.

Affected VersionsENISA

nanoid 0 <5.1.16

Affected Packages

npm nanoid fix: 3.3.16, 5.1.16

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in npm

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

nanoid is a very small, widely used ID/string generator for JavaScript. The flaw is CWE-835 (Loop with Unreachable Exit Condition / infinite loop) in the non-secure entry point (nanoid/non-secure), which trades cryptographic randomness for speed and is commonly used for non-security identifiers. The affected CPE is cpe:2.3:a:nanoid_project:nanoid. Internally these functions build the output by looping while decrementing a length counter toward zero; a negative size means the counter starts below the termination boundary and is decremented further, so the exit condition is never met and the single-threaded JavaScript runtime hangs on that call, stalling the whole event loop rather than merely returning a bad value.

Know when Nanoid gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (VulnCheck) PRIMARY 8.2 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

vuln.today AI 5.9 MEDIUM

Network-reachable only when the app forwards unvalidated negative size, an application-specific precondition modeled as AC:H; availability-only impact so C:N/I:N/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE 5.9 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H

Red Hat 7.5 HIGH

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

Present

Privileges Required

None

User Interaction

None

Vulnerable system: Confidentiality

None

Vulnerable system: Integrity

None

Vulnerable system: Availability

High

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

DescriptionCVE.org

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

227 npm packages depend on nanoid (84 direct, 146 indirect)

Ecosystem-wide dependent count for version 4.0.0.

Latest POC

1 PoC candidate from github (unverified)

Executive ViewAI

Why It Matters

The nanoid JavaScript library versions prior to 5.1.16 contain a denial-of-service vulnerability that can hang application threads and block event loops, causing service disruptions for production systems. Organizations using this widely-deployed UUID generation library must patch immediately to restore resilience and prevent customer-facing availability incidents.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.3%

Top 76% exploitable

Prevalence

High

extremely popular npm library, heavy transitive dependency across JS ecosystem

Threat Intel

1 sources

Data Quality

8 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment GHSA Vendor

GitHub

VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC Yes

EPSS 0.3%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision

Scheduled

Exploitation

None

System Exposure· derived

Open

Automatable

Human Impact

High

Technical Impact

Partial

Priority Score

Low Medium High Critical

KEV: 0

EPSS: 0

CVSS: +41

PoC: +20

Weaponized: 0

Threat intel: 0

Gov advisory: 0

Attack Technique

Denial of Service MEDIUM

Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.

More in Nanoid

View all

CVE-2026-67213 HIGH This Week POC

8.2 Jul 29

Denial-of-service in nanoid (Nano ID) versions before 5.1.6 lets an attacker hang a Node.js/JavaScript thread by supplyi

Same weakness CWE-835 – Loop with Unreachable Exit Condition (Infinite Loop)

View all

CVE-2024-20353 HIGH POC

8.6

CVE-2020-13935 HIGH POC

7.5

CVE-2017-16944 HIGH POC

7.5

CVE-2023-34966 HIGH

7.5

CVE-2022-0778 HIGH POC

7.5

CVE-2024-43366 CRITICAL POC

9.1

CVE-2026-25533 HIGH POC

8.8

CVE-2018-8002 HIGH POC

8.8

Same technique Denial Of Service

View all

CVE-2015-5119 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2011-0611 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2014-1761 HIGH POC

7.8

CVE-2015-5122 CRITICAL POC

9.8

CVE-2011-0609 HIGH POC

7.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 12	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7	Not-Affected

References

Advisories & patches

PATCH https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49 ADVISORY https://access.redhat.com/errata/RHSA-2026:48241 ADVISORY https://access.redhat.com/errata/RHSA-2026:48320 ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-67214 ADVISORY https://vuldb.com/vuln/384173 REF https://github.com/ai/nanoid/releases/tag/3.3.16 REF https://github.com/ai/nanoid/releases/tag/5.1.16 REF https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module

Search Externally

GitHub PoC

Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC

Back