CVE-2026-67213: Nano ID Denial of Service Vulnerability

CVE-2026-67213 Overview

CVE-2026-67213 is an infinite loop vulnerability in the nanoid (Nano ID) JavaScript library before version 5.1.6. The flaw resides in the customAlphabet and customRandom functions. When a caller passes size = 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. Applications that forward unvalidated, attacker-controlled size values to these functions become exposed to a denial-of-service (DoS) condition. The weakness is tracked under CWE-835 (Loop with Unreachable Exit Condition).

Critical Impact
A remote, unauthenticated attacker can hang a Node.js worker or event loop by submitting a size=0 value, leading to service unavailability without any privileges or user interaction.

Affected Products

nanoid (Nano ID) npm package, all versions prior to 5.1.6
Node.js applications that expose customAlphabet or customRandom to user-controlled input
Downstream libraries and frameworks that transitively depend on vulnerable nanoid releases

Discovery Timeline

2026-07-29 - CVE-2026-67213 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67213

Vulnerability Analysis

The nanoid library generates URL-friendly unique identifiers using cryptographically secure random bytes. The customAlphabet(alphabet, defaultSize) and customRandom(alphabet, defaultSize, getRandom) factory functions return a generator that produces IDs of a caller-specified length. Internally, the generator enters a while (true) loop that appends characters until the accumulated ID length reaches the requested size. When size equals 0, the exit predicate is never satisfied because the loop keeps generating bytes without incrementing toward a target length that matches the empty base state, causing the loop to run forever.

Root Cause

The root cause is missing input validation on the size parameter inside the returned closure. The generator assumed callers would supply a positive integer and did not reject 0. Because Node.js executes JavaScript on a single-threaded event loop per worker, an infinite loop in user code blocks all subsequent request processing on that worker, producing a full stop of the service.

Attack Vector

An attacker exploits the flaw over the network by supplying a request field that is later forwarded, unsanitized, to customAlphabet(...)(size) or customRandom(...)(size). Common exposure patterns include APIs that accept an ID-length query parameter, GraphQL resolvers that pass client input to ID generation, and background jobs that read size from message payloads. No authentication, credentials, or user interaction are required.

javascript

// Security patch in index.js - Reject size=0
   let step = Math.ceil((1.6 * mask * defaultSize) / alphabet.length)
 
   return (size = defaultSize) => {
+    if (size === 0) {
+      throw new Error('ID size is 0')
+    }
+
     let id = ''
     while (true) {
       let bytes = getRandom(step)
// Source: https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7

The patch adds an explicit guard that throws Error('ID size is 0') before entering the while (true) loop, converting the hang into a fast, catchable failure.

Detection Methods for CVE-2026-67213

Indicators of Compromise

Node.js worker processes pinned at 100% CPU on a single core with no I/O progress.
Event-loop lag metrics that climb without recovery after specific HTTP requests.
Health-check timeouts and load-balancer 502/504 responses correlated to requests carrying size=0 or empty numeric length fields.
Stack traces from process dumps showing execution stuck inside nanoidcustomAlphabet or customRandom frames.

Detection Strategies

Inventory application dependencies using npm ls nanoid or yarn why nanoid and flag any resolved version below 5.1.6, including transitive pins.
Use Software Composition Analysis (SCA) rules mapped to CVE-2026-67213 in CI pipelines to fail builds that pull vulnerable nanoid releases.
Add runtime assertions in wrappers around customAlphabet and customRandom that log calls where size <= 0 before the patch is applied.

Monitoring Recommendations

Ship Node.js event-loop lag, CPU-per-worker, and request-duration histograms to a central data lake, such as SentinelOne Singularity Data Lake, and alert on sustained single-worker CPU saturation.
Correlate web application firewall (WAF) request bodies containing "size":0 or size=0 with backend latency spikes.
Monitor process restarts and out-of-memory events on Node.js services that expose ID-generation endpoints.

How to Mitigate CVE-2026-67213

Immediate Actions Required

Upgrade nanoid to version 5.1.6 or later across all direct and transitive dependencies.
Audit application code for any path where user input reaches customAlphabet(...)(size) or customRandom(...)(size) and add strict validation.
Reject requests where the length field is missing, non-numeric, less than 1, or greater than a documented maximum.

Patch Information

The fix is available in the nanoid 5.1.6 release and lands in commit cb3626d. See the VulnCheck advisory for full advisory metadata. Update the package with npm install nanoid@^5.1.6 and rebuild any lockfiles.

Workarounds

Wrap customAlphabet and customRandom in a helper that throws when size < 1, mirroring the upstream guard.
Enforce a maximum ID length at the API boundary using schema validation with libraries such as zod, joi, or ajv.
Deploy WAF rules that block request payloads with size=0 targeting known ID-generation endpoints until the patched version is deployed.

bash

# Configuration example: upgrade nanoid and verify the resolved version
npm install nanoid@^5.1.6
npm ls nanoid | grep -v '5.1.[6-9]\|5.[2-9]' && echo 'Vulnerable copy still present' || echo 'OK'