GHSA-2v37-7h3g-55p8 high
nanoid: custom generators can loop indefinitely when size is zero
Affected range
SEMVER: introduced 0; fixed 3.3.18SEMVER: introduced 4.0.0; fixed 5.1.6Fixed versions: 3.3.18, 5.1.6
nanoid
A tiny (118 bytes), secure URL-friendly unique string ID generator
npm latest 6.0.1 MIT
Evidence path
Version, exploitation, severity
RequestGuard keeps these facts separate. A KEV match refers to a CVE, while OSV supplies the package and version match.
1
Latest version
6.0.1
No matching published advisory returned
2
Known exploitation
No KEV match
Checked by exact CVE identifier
3
Highest advisory severity
High
5 active advisories
Check an exact version
The registry confirms the version, then OSV checks advisories for that exact value.
Published records
Advisories
GHSA-28wg-ghj8-5hjv high
nanoid: non-secure generators can loop indefinitely with negative size
Affected range
SEMVER: introduced 0; fixed 3.3.16SEMVER: introduced 4.0.0; fixed 5.1.16Fixed versions: 3.3.16, 5.1.16
GHSA-xwg4-73v4-xw9w high
nanoid: Integer Overflow or Wraparound
Affected range
SEMVER: introduced 0; fixed 3.3.12SEMVER: introduced 4.0.0; fixed 5.1.11Fixed versions: 3.3.12, 5.1.11
GHSA-mwcw-c2x4-8c55 moderate
Predictable results in nanoid generation when given non-integer values
Affected range
SEMVER: introduced 4.0.0; fixed 5.0.9SEMVER: introduced 0; fixed 3.3.8Fixed versions: 5.0.9, 3.3.8
GHSA-qrpm-p2h7-hrv2 moderate
Exposure of Sensitive Information to an Unauthorized Actor in nanoid
Affected range
SEMVER: introduced 3.0.0; fixed 3.1.31Fixed versions: 3.1.31