CVE-2024-55565: Nano ID Input Validation Vulnerability

CVE-2024-55565 Overview

CVE-2024-55565 is a vulnerability affecting nanoid (Nano ID), a popular JavaScript library used for generating unique, URL-safe identifiers. The vulnerability exists in versions before 5.0.9 (and before 3.3.8 in the 3.x branch) where the library mishandles non-integer values, potentially leading to an infinite loop condition (CWE-835).

Nano ID is widely used in web applications, APIs, and database systems for generating compact unique identifiers. The improper handling of non-integer input values can cause the application to enter an infinite loop, resulting in resource exhaustion and denial of service conditions.

Critical Impact

Applications using vulnerable versions of Nano ID may experience denial of service when non-integer values are passed to the ID generation functions, causing infinite loops that exhaust system resources.

Affected Products

• nanoid versions before 5.0.9
• nanoid 3.x versions before 3.3.8
• Applications and services using vulnerable nanoid versions

Discovery Timeline

• 2024-12-09 - CVE-2024-55565 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2024-55565

Vulnerability Analysis

The vulnerability in Nano ID stems from improper input validation when processing the size parameter used for ID generation. When a non-integer value (such as a floating-point number or non-numeric string) is passed to the nanoid function, the library fails to properly validate and handle this input, resulting in an infinite loop condition.

This is classified as CWE-835 (Loop with Unreachable Exit Condition), indicating that under certain input conditions, the loop control logic fails to reach a terminating state. The vulnerability can be exploited remotely over the network by an authenticated attacker who can influence the parameters passed to the ID generation functions.

The impact is primarily on availability, as the infinite loop can cause the application thread or process to hang indefinitely, consuming CPU resources and potentially causing denial of service for the affected application.

Root Cause

The root cause of CVE-2024-55565 is insufficient input validation in the Nano ID library's core ID generation logic. The library did not properly validate that the size parameter is a valid positive integer before using it in loop calculations. When non-integer values are provided, the loop termination condition may never be satisfied, causing the function to loop indefinitely.

The fix implemented in versions 5.0.9 and 3.3.8 adds proper type checking and validation to ensure that only valid integer values are accepted, preventing the infinite loop condition from occurring.

Attack Vector

The attack vector for this vulnerability is network-based. An attacker with low privileges (authenticated access) can exploit this vulnerability by providing malicious non-integer input to application endpoints that use the Nano ID library for ID generation.

Attack scenarios include:

1. API Parameter Manipulation: If an application allows users to specify ID length parameters that are passed to nanoid, an attacker could provide non-integer values to trigger the infinite loop
2. Indirect Input Injection: Through form fields, query parameters, or JSON payloads that ultimately influence the size parameter passed to the ID generation function
3. Configuration Poisoning: In scenarios where configuration values control ID generation parameters, malicious configuration could trigger the vulnerability

The vulnerability does not require user interaction and can be triggered programmatically, making it suitable for automated attacks.

Detection Methods for CVE-2024-55565

Indicators of Compromise

• Unusually high CPU utilization on application servers without corresponding increases in legitimate traffic
• Application threads or processes becoming unresponsive or hanging indefinitely
• Request timeouts in application logs associated with ID generation operations
• Memory growth patterns indicating loop-related resource accumulation

Detection Strategies

• Implement software composition analysis (SCA) to identify applications using vulnerable nanoid versions (< 5.0.9 or 3.x < 3.3.8)
• Monitor application performance metrics for sudden CPU spikes without corresponding legitimate load increases
• Deploy application performance monitoring (APM) to detect hung threads or processes in ID generation code paths
• Review dependency manifests (package.json, package-lock.json, yarn.lock) for vulnerable nanoid versions

Monitoring Recommendations

• Configure alerts for application response time degradation that could indicate infinite loop conditions
• Monitor process CPU time and set thresholds for detecting runaway threads
• Implement health check endpoints that verify ID generation functionality
• Log and alert on unusual parameter values being passed to ID generation functions

How to Mitigate CVE-2024-55565

Immediate Actions Required

• Upgrade nanoid to version 5.0.9 or later for applications using the 5.x branch
• Upgrade nanoid to version 3.3.8 or later for applications using the 3.x branch
• Audit application code to identify all usages of the nanoid library
• Implement input validation for any user-controllable parameters that influence ID generation

Patch Information

The vulnerability has been addressed in the following releases:

• nanoid 5.0.9: GitHub NanoID Release 5.0.9
• nanoid 3.3.8: GitHub NanoID Version Comparison

The fix was implemented via GitHub Pull Request #510, which adds proper input validation to prevent non-integer values from causing infinite loops.

Debian users should refer to the Debian LTS Security Announcement for distribution-specific patching guidance.

Workarounds

• Implement input validation at the application layer to ensure only valid positive integers are passed to nanoid functions
• Add request timeouts around ID generation operations to prevent indefinite hangs from impacting overall application availability
• Deploy rate limiting to reduce the impact of repeated exploitation attempts
• Consider using static ID lengths rather than user-controllable parameters until patching is complete

# Update nanoid to patched version
npm update nanoid

# Or specify exact version in package.json
npm install nanoid@5.0.9

# For 3.x branch
npm install nanoid@3.3.8

# Verify installed version
npm list nanoid