Skip to main content

nanoid EUVDEUVD-2026-56554

| CVE-2026-73086 HIGH
Integer Overflow or Wraparound (CWE-190)
2026-08-11 security-advisories@github.com
Integer Overflow CSRF Red Hat Suse
7.4
CVSS 3.1 · Vendor: github
Share

Severity by source

Vendor (github) PRIMARY
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
vuln.today AI
7.4 HIGH

AC:H because exploitation requires attacker-controlled input reaching nanoid(size); C:H and I:H because all subsequent tokens become fully predictable; A:N since the process continues executing normally.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
SUSE
8.1 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (github).

CVSS VectorVendor: github

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

4
Patch available
Aug 11, 2026 - 18:19 EUVD
Source Code Evidence Fetched
Aug 11, 2026 - 17:45 vuln.today
Analysis Generated
Aug 11, 2026 - 17:45 vuln.today
CVE Published
Aug 11, 2026 - 17:19 cve.org
HIGH 7.4

DescriptionCVE.org

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

AnalysisAI

Integer overflow in nanoid's size coercion path silently corrupts the process-wide CSPRNG pool, causing every identifier generated after the trigger event to collapse to the deterministic fixed string 'uuuuuuuuuuuuuuuuuuuuu' for the entire remaining lifetime of the Node.js process. Applications relying on nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) for session tokens, CSRF tokens, or API key generation are exposed to complete token predictability and forgery with no runtime error or log entry to signal the failure. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Identify endpoint forwarding user input to nanoid(size)
Delivery
Submit size=2147483648 in single request
Exploit
Signed 32-bit integer overflow wraps value to -2147483648
Execution
fillPool() guard silently zeroes request, corrupting global poolOffset
Persist
All subsequent nanoid() calls return 'uuuuuuuuuuuuuuuuuuuuu'
Impact
Forge session tokens and CSRF tokens to hijack arbitrary accounts
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires that attacker-controlled or attacker-influenced input reaches the size parameter of a nanoid(size) call without prior numeric validation - for example, an API that accepts a requested ID or token length and forwards it directly to the library. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 7.4 score and vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N accurately models this flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker discovers an API endpoint that accepts a user-supplied token-length parameter and passes it without validation to nanoid(size) - for example, a 'generate API key of length N' feature. The attacker sends a single request with the value 2147483648, which the library coerces to -2147483648, silently zeroing the CSPRNG pool request and corrupting the global poolOffset. …
Remediation Upgrade nanoid to version 3.3.12 if on the v3 branch, or to 5.1.11 if on the v5 branch; these are the vendor-confirmed patched releases documented at https://github.com/ai/nanoid/releases/tag/3.3.12 and https://github.com/ai/nanoid/releases/tag/5.1.11, backed by fix commits 7087969281cab8ba8ae3babf1894e819068b3bb4, 821dfed7b5db7f88e92f56c60eef32c8135077c3, and b0036ed60dc9facd7f1191a50dfb3076500202ac. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all production applications using nanoid versions prior to 3.3.12 (v3 branch) or 5.1.11 (v5 branch) through automated dependency scanning and notify affected engineering teams of the critical patch requirement. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5
CVE-2016-1010 HIGH
8.8

Same technique Integer Overflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2013-2729 CRITICAL POC
9.8
CVE-2015-8651 HIGH
8.8
CVE-2012-5054 HIGH POC
8.8
CVE-2014-0569 CRITICAL POC
9.3
CVE-2023-21716 CRITICAL POC
9.8
CVE-2017-3599 HIGH POC
7.5
CVE-2017-7529 HIGH
7.5

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Not-Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected

Share

EUVD-2026-56554 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy