CVE-2026-67214

Name of the Vulnerable Software and Affected Versions anoid versions prior to 5.1.16

Description The non-secure module (nanoid/non-secure) contains an infinite loop within the customAlphabet() and nanoid() functions. This occurs when these functions receive a negative value for the size parameter. Because the loop counter is decremented from a negative value, it never reaches the termination condition, causing the calling thread to hang. An application that allows an attacker to control the size parameter without validation is susceptible to a denial-of-service condition.

Recommendations Update to version 5.1.16 or later. As a temporary mitigation, ensure that the size parameter passed to the customAlphabet() and nanoid() functions is validated to be a non-negative integer.