fix(deps): update dependency nanoid to v5.1.16 [security]

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid	5.0.7 → 5.1.16

---

Predictable results in nanoid generation when given non-integer values

CVE-2024-55565 / GHSA-mwcw-c2x4-8c55

More information

Details

When nanoid is called with a fractional value, there were a number of undesirable effects:

1. in browser and non-secure, the code infinite loops on while (size--)
2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

Severity

• CVSS Score: 4.3 / 10 (Medium)
• Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2024-55565
• https://github.com/ai/nanoid/pull/510
• https://github.com/ai/nanoid/compare/3.3.7...3.3.8
• https://github.com/ai/nanoid/releases/tag/5.0.9
• https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
• https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html
• https://github.com/advisories/GHSA-mwcw-c2x4-8c55

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

nanoid: custom generators can loop indefinitely when size is zero

CVE-2026-67213 / GHSA-2v37-7h3g-55p8

More information

Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-67213
• https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
• https://github.com/ai/nanoid/releases/tag/5.1.6
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
• https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b
• https://github.com/ai/nanoid/releases/tag/3.3.17
• https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0
• https://github.com/ai/nanoid/releases/tag/3.3.18
• https://github.com/advisories/GHSA-2v37-7h3g-55p8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

nanoid: non-secure generators can loop indefinitely with negative size

CVE-2026-67214 / GHSA-28wg-ghj8-5hjv

More information

Details

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-67214
• https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
• https://github.com/ai/nanoid/releases/tag/5.1.16
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
• https://github.com/ai/nanoid/pull/600
• https://github.com/ai/nanoid/pull/601
• https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d
• https://github.com/advisories/GHSA-28wg-ghj8-5hjv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

nanoid: Integer Overflow or Wraparound

CVE-2026-73086 / GHSA-xwg4-73v4-xw9w

More information

Details

Summary

An integer overflow in nanoid(size) permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string "uuuuuuuuuuuuuuuuuuuuu". Any application that passes user-influenced values to the size parameter loses all randomness guarantees for session tokens, CSRF tokens, and unique identifiers until process restart.

Details

nanoid() at index.js:101 coerces the size parameter with size |= 0, which converts it to a signed 32-bit integer. When size >= 2^31 (e.g., 2147483648), this wraps to -2147483648.

The negative value is passed to fillPool() (index.js:15):

function fillPool(bytes) {
  if (!pool || pool.length < bytes) {       // false: pool exists, -2B < pool.length
    pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER)
    crypto.getRandomValues(pool)
    poolOffset = 0
  } else if (poolOffset + bytes > pool.length) {  // false: poolOffset + (-2B) < pool.length
    crypto.getRandomValues(pool)
    poolOffset = 0
  }
  poolOffset += bytes  // poolOffset += -2147483648 → deeply negative
}

Neither branch triggers, so the pool is never refreshed. poolOffset becomes ~-2.1 billion.

Subsequent nanoid() calls execute:

for (let i = poolOffset - size; i < poolOffset; i++) {
  id += scopedUrlAlphabet[pool[i] & 63]
}

pool[negative_index] returns undefined. undefined & 63 evaluates to 0. urlAlphabet[0] is 'u'. Every ID becomes "uuuuuuuuuuuuuuuuuuuuu".

The corruption is persistent — it affects all subsequent calls in the process until ~100 million calls eventually wrap poolOffset back to positive, or the process restarts.

PoC

import { nanoid } from 'nanoid'

// Step 1: Normal operation
console.log(nanoid())  // e.g., "V1StGXR8_Z5jdHi6B-myT"

// Step 2: Trigger overflow (e.g., from an API parameter)
try { nanoid(2147483648) } catch(e) {}

// Step 3: All subsequent IDs are deterministic
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
// ... forever, process-wide

Run with: node --experimental-vm-modules poc.mjs

Attack scenario: Any API endpoint that accepts a user-controlled length/size parameter (URL shortener slug length, configurable token size, etc.) and passes it to nanoid(userInput).

Impact

Complete loss of ID unpredictability and uniqueness, process-wide, from a single request.

• All session IDs, CSRF tokens, API keys, and database identifiers generated after the attack are identical and predictable
• An attacker can predict all tokens issued to other users, enabling session hijacking and authentication bypass
• The corruption is persistent (survives across requests) and affects all consumers of nanoid in the same process
• No special privileges or preconditions required — a single unauthenticated request is sufficient
• Affects any application that passes external input to the size parameter without validation

Severity

• CVSS Score: 7.4 / 10 (High)
• Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

• https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w
• https://nvd.nist.gov/vuln/detail/CVE-2026-73086
• https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4
• https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3
• https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac
• https://github.com/ai/nanoid/releases/tag/3.3.12
• https://github.com/ai/nanoid/releases/tag/5.1.11
• https://github.com/advisories/GHSA-xwg4-73v4-xw9w

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ai/nanoid (nanoid)

v5.1.16

Compare Source

• Fixed forever loop on negative size (by @​spokodev).

v5.1.15

Compare Source

• Fixed random pool corruption on big ID sizes.

v5.1.14

Compare Source

• Fixed npm package size regression.

v5.1.13

Compare Source

• Fixed npm package size regression.

v5.1.12

Compare Source

• Moved to npm Provenance and Staged Publishing.

v5.1.11

Compare Source

• Fixed breaking Nano ID by requesting big ID.

v5.1.10

Compare Source

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

v5.1.9

Compare Source

• Fixed npm package size regression.

v5.1.8

Compare Source

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

v5.1.7

Compare Source

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

v5.1.6

Compare Source

• Fixed infinite loop on 0 size for customAlphabet.

v5.1.5

Compare Source

• Fixed latest version on npm after 3.x release.

v5.1.4

Compare Source

• Fixed latest version on npm after 3.x release.

v5.1.3

Compare Source

• Fixed React Native support (by @​steida).

v5.1.2

Compare Source

• Fixed module docs.

v5.1.1

Compare Source

• Fixed breaking Nano ID by requesting big ID.

v5.1.0

Compare Source

• Added opaque types support (by @​kossnocorp).

v5.0.9

Compare Source

• Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v5.0.8

Compare Source

• Reduced customAlphabet size (by @​kirillgroshkov).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
chirpy	Ready	Preview	Oct 3, 2026 11:02pm UTC

[changeset-bot]

⚠️ No Changeset found

Latest commit: 917b37d

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[relativeci]

#1454 Bundle Size — 2.56MiB (0%).

2c8d1dd(current) vs 3b6dffc main#1453(baseline)

Warning

Bundle contains 4 duplicate packages – View duplicate packages

Bundle metrics   1 change

	Current #1454	Baseline #1453
Initial JS	1.63MiB	1.63MiB
Initial CSS	89.92KiB	89.92KiB
Cache Invalidation	0.16%	65.38%
Chunks	60	60
Assets	80	80
Modules	1817	1817
Duplicate Modules	254	254
Duplicate Code	5.85%	5.85%
Packages	151	151
Duplicate Packages	3	3

Bundle size by type  no changes

	Current #1454	Baseline #1453
JS	2.24MiB	2.24MiB
Fonts	213.87KiB	213.87KiB
CSS	89.92KiB	89.92KiB
Other	15.35KiB	15.35KiB
IMG	1.73KiB	1.73KiB

Bundle analysis report Branch refs/pull/591/merge Project dashboard

---

^{Generated by RelativeCI Documentation Report issue}