Infinite Loop Denial-of-Service in Nano ID Non-Secure Module

Executive Summary

This vulnerability is an infinite loop flaw in the Nano ID library before version 5.1.16. It occurs in the non-secure module's customAlphabet and nanoid functions when a negative size is provided. The loop counter decrements from a negative value and never meets the termination condition, causing the thread to hang indefinitely. This results in a denial-of-service condition for any application using these functions with unvalidated, attacker-controlled negative input.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to the nanoid library and can be detected by checking the installed version of nanoid. If your application uses nanoid and the version is below 5.1.16, it is vulnerable. Run: npm list nanoid or check the package.json file for the version.

Useful 0 Not Useful 0

Impact Analysis

If you use the affected Nano ID library versions in your application, an attacker could exploit this flaw by providing a negative size value. This would cause your application to hang or crash, leading to degraded performance or complete unavailability. Systems relying on Nano ID for unique ID generation could become unresponsive, disrupting services and user access.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance by causing service disruptions or data processing delays, potentially violating availability requirements in GDPR and HIPAA. Downtime from a denial-of-service condition may lead to breaches of service level agreements or regulatory timeframes for data access and processing.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade the nanoid library to version 5.1.16 or later. For npm projects, run: npm install nanoid@latest. For other package managers, update the dependency accordingly. Ensure no code passes unvalidated negative sizes to nanoid functions.

Useful 0 Not Useful 0