nanoid npm Package Under Investigation for Infinite Loop Vulnerability
An early warning has been issued regarding the nanoid npm package versions before 5.1.6, which reportedly contains an infinite loop in the customAlphabet and customRandom functions when configured with a size of 0. This appears to lead to a denial-of-service condition if an unvalidated, attacker-controlled size of 0 is passed to these functions.
What happened
The nanoid npm package, utilized for generating unique identifiers, is under investigation for a vulnerability tracked as GHSA-2v37-7h3g-55p8. This vulnerability, reportedly present in versions before 5.1.6, involves an infinite loop in the customAlphabet and customRandom functions when these are configured with a size of 0. This condition can be exploited to cause a denial-of-service if an attacker manages to pass an unvalidated size of 0 to these functions.
To assess your exposure, review your project dependencies for any instances of the nanoid package prior to version 5.1.6. If your project utilizes this package, it is recommended to upgrade to version 5.1.6 or later to mitigate the risk of this denial-of-service condition. For more detailed information, consult the primary sources linked in the threat data.
How 0Day mitigates this
nanoid is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.