CVE-2026-73086

HIGH 7.4

nanoid: Integer Overflow or Wraparound

CVSS Score

7.4

EPSS Score

0.0%

EPSS Percentile

0th

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

CWE	CWE-190
Vendor	ai
Product	nanoid
Published	Aug 11, 2026

Stay Ahead of the Next One

Get instant alerts for ai nanoid

Be the first to know when new high vulnerabilities affecting ai nanoid are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

ai / nanoid

< 3.3.12 >= 4.0.0, < 5.1.11

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w github.com: https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4 github.com: https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3 github.com: https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac github.com: https://github.com/ai/nanoid/releases/tag/3.3.12 github.com: https://github.com/ai/nanoid/releases/tag/5.1.11