CyberRota Analysis
AI-GeneratedThe vulnerability affects the nanoid library versions prior to 5.1.16, specifically within its non-secure module, where the customAlphabet and nanoid functions can enter an infinite loop if provided with a negative size. This flaw can lead to a denial-of-service condition, causing applications to hang indefinitely when an attacker manipulates input. Developers using affected versions of nanoid should prioritize upgrading to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.
Related CVEs
Other vulnerabilities affecting the same vendor(s)