Nanoid
Monthly
Denial-of-service in the nanoid JavaScript library (versions before 5.1.16) lets an attacker hang a Node.js/browser thread by supplying a negative size to the customAlphabet or nanoid functions of the non-secure module (nanoid/non-secure). Because the internal loop counter is decremented from a negative starting value, it never satisfies its termination condition and spins forever, consuming CPU and blocking the event loop. Reported by VulnCheck with a patch shipped in 5.1.16; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in nanoid (Nano ID) versions before 5.1.6 lets an attacker hang a Node.js/JavaScript thread by supplying a size value of 0 to the customAlphabet or customRandom generator functions, triggering an unbounded internal loop (CWE-835). Only applications that forward an unvalidated, attacker-controlled size parameter to these functions are exposed. A vendor patch exists (5.1.6) and the issue was reported by VulnCheck, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in the nanoid JavaScript library (versions before 5.1.16) lets an attacker hang a Node.js/browser thread by supplying a negative size to the customAlphabet or nanoid functions of the non-secure module (nanoid/non-secure). Because the internal loop counter is decremented from a negative starting value, it never satisfies its termination condition and spins forever, consuming CPU and blocking the event loop. Reported by VulnCheck with a patch shipped in 5.1.16; no public exploit identified at time of analysis and it is not listed in CISA KEV.
Denial-of-service in nanoid (Nano ID) versions before 5.1.6 lets an attacker hang a Node.js/JavaScript thread by supplying a size value of 0 to the customAlphabet or customRandom generator functions, triggering an unbounded internal loop (CWE-835). Only applications that forward an unvalidated, attacker-controlled size parameter to these functions are exposed. A vendor patch exists (5.1.6) and the issue was reported by VulnCheck, but there is no public exploit identified at time of analysis and it is not listed in CISA KEV.