{"action":"Upgrade nanoid to 3.3.18 or later.","affected":[{"fixed":"3.3.18","introduced":"0"},{"fixed":"5.1.6","introduced":"4.0.0"}],"component":"nanoid","cve_ids":["CVE-2026-67213"],"ecosystem":"npm","epss":0.00331,"exploited":false,"fixed_versions":["3.3.18","5.1.6"],"ghsa_id":"GHSA-2v37-7h3g-55p8","id":"tcs_01M5KEV348AR3T20KKMS48G44Q","modified_at":"2026-09-10T03:50:51.243328986Z","published_at":"2026-07-29T15:31:12Z","references":["https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8","https://nvd.nist.gov/vuln/detail/CVE-2026-67213","https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7","https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0","https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b","https://github.com/ai/nanoid","https://github.com/ai/nanoid/releases/tag/3.3.17","https://github.com/ai/nanoid/releases/tag/3.3.18","https://github.com/ai/nanoid/releases/tag/5.1.6","https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-2v37-7h3g-55p8","url":"https://osv.dev/vulnerability/GHSA-2v37-7h3g-55p8"}],"summary":"nanoid: custom generators can loop indefinitely when size is zero"}