CVE-2026-67214

Katalog CVE

CVSS 7.5 · High EPSS 0,33%

Kerentanan Loop with Unreachable Exit Condition ('Infinite Loop') pada nanoid project nanoid. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Rincian

Terbit di NVD

29 Juli 2026

Terakhir diubah

8 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')

EPSS (30 hari)

0,33% peluang dieksploitasi; lebih tinggi dari 24,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49 patch
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module patch · release notes · advisory pihak ketiga
• https://github.com/ai/nanoid/releases/tag/3.3.16 product · release notes
• https://github.com/ai/nanoid/releases/tag/5.1.16 product · release notes