Description
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| ai | nanoid | < 3.3.12, >= 4.0.0, < 5.1.11 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | node-mocha | 9.1.4+ds1+~cs28.2.8-1 | — |
| Debian 14 | node-postcss | 8.5.14+~cs9.3.34-1 | — |
| Debian 13 | node-mocha | 9.1.4+ds1+~cs28.2.8-1 | — |
| Debian 13 | node-postcss | No fix yet | — |
| Debian 12 | node-mocha | 9.1.4+ds1+~cs28.2.8-1 | — |
| Debian 12 | node-postcss | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 24.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 22.04 LTS | node-postcss | No fix yet | — |
| Ubuntu 20.04 LTS | node-mocha +1 | No fix yet | — |
| Ubuntu 18.04 LTS | node-mocha | No fix yet | — |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | node-mocha | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.18.0.14-1.el9sat | RHSA-2026:74503 |
| Red Hat Satellite Utils 6 | rubygem-hammer_cli | 3.18.0-2.el9sat | RHSA-2026:74503 |
| Red Hat Satellite Capsule 6 | foreman +2 | 3.18.0.14-1.el9sat | RHSA-2026:74503 |
| Red Hat Satellite Capsule 6 | python3.12-dynaconf | 3.2.13-2.el9pc | RHSA-2026:74503 |
| Red Hat Satellite Capsule 6 | python3.12-gitpython | 3.1.62-1.el9pc | RHSA-2026:74503 |
| Red Hat Satellite Capsule 6 | python3.12-sqlparse | 0.6.0-1.el9pc | RHSA-2026:74503 |
| Red Hat Satellite 6 | foreman +13 | 3.18.0.14-1.el9sat | RHSA-2026:74503 |
| Red Hat Satellite 6 | python3.12-dynaconf | 3.2.13-2.el9pc | RHSA-2026:74503 |
| Red Hat Satellite 6 | python3.12-gitpython | 3.1.62-1.el9pc | RHSA-2026:74503 |
| Red Hat Satellite 6 | python3.12-sqlparse | 0.6.0-1.el9pc | RHSA-2026:74503 |
| Red Hat Satellite 6 | rubygem-foreman_remote_execution +1 | 16.5.3-2.el9sat | RHSA-2026:74503 |
| Red Hat Satellite 6 | rubygem-hammer_cli | 3.18.0-2.el9sat | RHSA-2026:74503 |
| Red Hat Satellite 6 | rubygem-katello | 4.20.0.11-1.el9sat | RHSA-2026:74503 |
| Red Hat Satellite 6 | yggdrasil-worker-forwarder | 0.1.0-2.1.el9sat | RHSA-2026:74503 |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Hardened Images 1 | grafana12.4 | 12.4.8-0.1.1.hum1 | RHSA-2026:54518 |
| Red Hat Hardened Images 1 | grafana13.1 | 13.1.3-0.1.hum1 | RHSA-2026:54412 |
| Red Hat Hardened Images 1 | jaeger | 2.20.0-0.8.hum1 | RHSA-2026:48758 |
| Red Hat Hardened Images 1 | prometheus3.13 | 3.13.2-0.2.hum1 | RHSA-2026:50287 |
| Red Hat Hardened Images 1 | prometheus3.5 | 3.5.5-0.8.hum1 | RHSA-2026:54520 |
| Red Hat Ansible Automation Platform Inside 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | automation-controller +1 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | python3.12-sqlparse | 0.6.0-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform Developer 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-controller +4 | 4.7.17-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-gateway-proxy-server | 2.6.17-3.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | automation-platform-ui | 2.6.14-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python-sqlparse +1 | 0.6.0-1.el10ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-gitpython | 3.1.60-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | python3.12-sqlparse | 0.6.0-1.el9ap | RHSA-2026:71113 |
| Red Hat Ansible Automation Platform 2 | receptor | 1.6.8-1.el9ap | RHSA-2026:71113 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | agama-web-ui | 24+0.a836cced5-52.1 | openSUSE-SU-2026:11680-1 |
| openSUSE Tumbleweed | velociraptor | 0.76.7.0.git145.b60ef1146-1.1 | openSUSE-SU-2026:12070-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | jupyter-base-notebook | 7.6.3-r2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| npm | nanoid | < 3.3.12 | 3.3.12 | GHSA-xwg4-73v4-xw9w |
| npm | nanoid | >= 4.0.0, < 5.1.11 | 5.1.11 | GHSA-xwg4-73v4-xw9w |
Advisories 12
- WID-SEC-2026-4056 Atlassian Produkte (Bamboo, Bitbucket, Confluence, Crucible, Fisheye und Jira): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-3376 Atlassian Bamboo, Bitbucket, Confluence, Fisheye/Crucible, Jira Software und Jira Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- RHSA-2026:74503 Red Hat Security Advisory: Satellite 6.19.5 Async Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:71113 Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54520 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54518 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:54412 Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:50287 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- RHSA-2026:48758 Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update Red Hat Security Advisories (RHSA) · Oct 20, 2026
- openSUSE-SU-2026:12070-1 velociraptor-0.76.7.0.git145.b60ef1146-1.1 on GA media SUSE / openSUSE Security Updates · Oct 7, 2026
- WID-SEC-2026-3461 HCL BigFix Service Management: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 5, 2026
- openSUSE-SU-2026:11680-1 agama-web-ui-24+0.a836cced5-52.1 on GA media SUSE / openSUSE Security Updates · Sep 5, 2026
References
- https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w
- https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
- https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
- https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
- https://github.com/ai/nanoid/releases/tag/3.3.12
- https://github.com/ai/nanoid/releases/tag/5.1.11