CVE-2026-73086

Name of the Vulnerable Software and Affected Versions anoid versions prior to 3.3.12 anoid versions prior to 5.1.11

Description The nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer. Providing a value of 2147483648 causes it to become -2147483648, which corrupts the process-wide CSPRNG (Cryptographically Secure Pseudo-Random Number Generator) poolOffset in the fillPool() function. This corruption results in subsequent session tokens, CSRF tokens, API keys, and unique identifiers becoming the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process is restarted.

Recommendations Update to version 3.3.12 or later. Update to version 5.1.11 or later.