CVE-2026-73086

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
https://github.com/ai/nanoid/releases/tag/3.3.12
https://github.com/ai/nanoid/releases/tag/5.1.11
https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w

Configurations

No configuration.

History

23 Oct 2026, 19:10

Type	Values Removed	Values Added
Summary		(es) nanoid es un generador de ID de cadena único, seguro y compatible con URL para JavaScript. Antes de las versiones 3.3.12 y 5.1.11, la función nanoid(size) en index.js e index.cjs coerciona el parámetro ’size’, influenciado por el usuario, a un entero con signo de 32 bits, permitiendo que un valor de 2147483648 se convierta en -2147483648 y corrompa el poolOffset del CSPRNG a nivel de proceso en fillPool(), lo que provoca que los subsiguientes tokens de sesión, tokens CSRF, claves API e identificadores únicos se conviertan en la cadena determinista ’uuuuuuuuuuuuuuuuuuuuu’ hasta que el proceso se reinicie. Este problema se ha solucionado en las versiones 3.3.12 y 5.1.11.

Information

Published : 2026-08-11 17:19

Updated : 2026-10-24 15:10

NVD link : CVE-2026-73086

Mitre link : CVE-2026-73086

CVE.ORG link : CVE-2026-73086

JSON object : View

Products Affected

No product.

CWE

CWE-190

Integer Overflow or Wraparound

{"id": "CVE-2026-73086", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-73086", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-08-12T14:26:22.656696Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 2.2}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "ai", "product": "nanoid", "versions": [{"status": "affected", "version": "< 3.3.12"}, {"status": "affected", "version": ">= 4.0.0, < 5.1.11"}]}]}], "published": "2026-08-11T17:19:16.690", "references": [{"url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4", "source": "security-advisories@github.com"}, {"url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3", "source": "security-advisories@github.com"}, {"url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac", "source": "security-advisories@github.com"}, {"url": "https://github.com/ai/nanoid/releases/tag/3.3.12", "source": "security-advisories@github.com"}, {"url": "https://github.com/ai/nanoid/releases/tag/5.1.11", "source": "security-advisories@github.com"}, {"url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-190"}]}], "descriptions": [{"lang": "en", "value": "nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11."}, {"lang": "es", "value": "nanoid es un generador de ID de cadena \u00fanico, seguro y compatible con URL para JavaScript. Antes de las versiones 3.3.12 y 5.1.11, la funci\u00f3n nanoid(size) en index.js e index.cjs coerciona el par\u00e1metro \u2019size\u2019, influenciado por el usuario, a un entero con signo de 32 bits, permitiendo que un valor de 2147483648 se convierta en -2147483648 y corrompa el poolOffset del CSPRNG a nivel de proceso en fillPool(), lo que provoca que los subsiguientes tokens de sesi\u00f3n, tokens CSRF, claves API e identificadores \u00fanicos se conviertan en la cadena determinista \u2019uuuuuuuuuuuuuuuuuuuuu\u2019 hasta que el proceso se reinicie. Este problema se ha solucionado en las versiones 3.3.12 y 5.1.11."}], "lastModified": "2026-10-24T15:10:00.190", "sourceIdentifier": "security-advisories@github.com"}