{"action":"Upgrade nanoid to 3.3.16 or later.","affected":[{"fixed":"3.3.16","introduced":"0"},{"fixed":"5.1.16","introduced":"4.0.0"}],"component":"nanoid","cve_ids":["CVE-2026-67214"],"ecosystem":"npm","epss":0.0033,"exploited":false,"fixed_versions":["3.3.16","5.1.16"],"ghsa_id":"GHSA-28wg-ghj8-5hjv","id":"tcs_01M5KESH9VZ0ZVVER5JJR42NB9","modified_at":"2026-09-10T03:50:51.191256883Z","published_at":"2026-07-29T15:31:12Z","references":["https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv","https://nvd.nist.gov/vuln/detail/CVE-2026-67214","https://github.com/ai/nanoid/pull/600","https://github.com/ai/nanoid/pull/601","https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49","https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d","https://github.com/ai/nanoid","https://github.com/ai/nanoid/releases/tag/5.1.16","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-28wg-ghj8-5hjv","url":"https://osv.dev/vulnerability/GHSA-28wg-ghj8-5hjv"}],"summary":"nanoid: non-secure generators can loop indefinitely with negative size"}