CVE-2026-67213

Name of the Vulnerable Software and Affected Versions anoid (Nano ID) versions prior to 5.1.6

Description The customAlphabet() and customRandom() functions contain an infinite loop. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition, which is a state where a system becomes unavailable to its intended users.

Recommendations Update nanoid (Nano ID) to version 5.1.6 or later. As a temporary workaround, avoid passing unvalidated user input to the size parameter of the customAlphabet() and customRandom() functions.