CVE-2026-67213

Katalog CVE

CVSS 7.5 · High EPSS 0,59%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada nanoid project nanoid. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Rincian

Terbit di NVD

29 Juli 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,59% peluang dieksploitasi; lebih tinggi dari 46,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7 patch
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customran... patch · release notes · advisory pihak ketiga
• https://github.com/ai/nanoid/releases/tag/5.1.6 product · release notes