CVE-2026-67213

Analyzed Analyzed - Analysis Complete

Infinite Loop Denial of Service in Nano ID

Publication date: 2026-07-29

Last updated on: 2026-08-18

Assigner: VulnCheck

Description

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-08-18

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67213

Affected Vendors & Products

Vendor	Product	Version / Range
nanoid_project	nanoid	From 3.0.0 (inc) to 3.3.17 (exc)
nanoid_project	nanoid	From 5.0.0 (inc) to 5.1.6 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-835	The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

Attack-Flow Graph

Executive Summary

Nano ID before version 5.1.6 has an infinite loop bug in customAlphabet and customRandom functions. When these functions receive a size parameter of 0, the loop never exits, causing the thread to hang indefinitely. This leads to a denial-of-service condition if an attacker controls the size input.

Detection Guidance

Check if your application uses nanoid versions before 5.1.6. Inspect code for calls to customAlphabet or customRandom with size 0. Monitor for hanging threads or processes consuming excessive CPU.

Impact Analysis

If you use an affected version of Nano ID and pass a size of 0 to customAlphabet or customRandom, your application may freeze or become unresponsive. This disrupts normal operations and can cause service outages or crashes.

Compliance Impact

This vulnerability causes a denial-of-service condition by hanging the calling thread, which could disrupt system availability. For compliance standards like GDPR and HIPAA, which require data availability and system reliability, this could lead to violations if services become unavailable due to the infinite loop.

Mitigation Strategies

Upgrade nanoid to version 5.1.6 or later. Validate all inputs passed to customAlphabet and customRandom to ensure size is greater than 0. Add input validation checks in your application.

Hi! I’m here to help you understand CVE-2026-67213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70