Description
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nanoid_project | nanoid | 4.0.0 – < 5.1.16, < 3.3.16 | 5.1.16 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-mocha | 9.1.4+ds1+~cs28.2.8-1 | — |
| Debian 14 | node-postcss | 8.5.15+~cs9.3.39-1 | — |
| Debian 13 | node-mocha | 9.1.4+ds1+~cs28.2.8-1 | — |
| Debian 13 | node-postcss | No fix yet | — |
| Debian 12 | node-mocha | 9.1.4+ds1+~cs28.2.8-1 | — |
| Debian 12 | node-postcss | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 24.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 22.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 20.04 LTS | node-postcss | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.1-0.3.hum1 | RHSA-2026:48241 |
| Red Hat Hardened Images 1 | grafana13.2 | 13.2.0-0.1.1.hum1 | RHSA-2026:59030 |
| Red Hat Hardened Images 1 | jaeger | 2.20.0-0.7.hum1 | RHSA-2026:48320 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-sqlparse | 0.6.0-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.6.17-3.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.14-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.60-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-sqlparse | 0.6.0-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jitsucom-jitsu-console | 2.11.0-r32 | — |
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
| Wolfi rolling | langfuse-3 +1 | 3.225.1-r1 | — |
| Wolfi rolling | langfuse-3-compat | 3.225.7-r6 | — |
| Wolfi rolling | nextcloud-server-33 | 33.0.7-r3 | — |
| Wolfi rolling | opensearch-dashboards-3-dashboards-maps | 3.7.0-r16 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | nanoid | < 3.3.16 | 3.3.16 | GHSA-28wg-ghj8-5hjv |
| npm | nanoid | >= 4.0.0, < 5.1.16 | 5.1.16 | GHSA-28wg-ghj8-5hjv |
Advisories 7
- RHSA-2026:71113 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3596 IBM App Connect Enterprise: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:48241 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:59030 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2026:48320 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 16, 2026
References
- v5.1.16 Release Notes release-notes
- v3.3.16 Release Notes release-notes
- Fix Commit patch
- VulnCheck Advisory third-party-advisory