CVE-2026-67214: nanoid (Nano ID) DOS Vulnerability

CVE-2026-67214 Overview

CVE-2026-67214 is an infinite loop vulnerability [CWE-835] in the nanoid (Nano ID) JavaScript library before version 5.1.16. The flaw affects the customAlphabet and nanoid functions exported from the non-secure module (nanoid/non-secure). When either function receives a negative size argument, the internal loop counter decrements from a negative value and never satisfies its termination condition. The calling thread spins indefinitely and hangs. Applications that forward unvalidated, attacker-controlled input to these functions become exposed to a denial-of-service (DoS) condition.

Critical Impact
A single request containing a negative integer size can hang the Node.js event loop or worker thread, exhausting CPU capacity and blocking legitimate requests.

Affected Products

nanoid (Nano ID) npm package versions prior to 5.1.16
The nanoid/non-secure submodule exposing customAlphabet and nanoid functions
JSR distribution @sitnik/nanoid versions prior to 5.1.16

Discovery Timeline

2026-07-29 - CVE-2026-67214 published to NVD
2026-07-29 - Last updated in NVD database

Technical Details for CVE-2026-67214

Vulnerability Analysis

The non-secure module of nanoid generates random identifiers using a lightweight loop that produces characters until the requested size is reached. The loop uses a decrementing counter compared against zero. When size is a negative integer, the counter starts below zero and continues to decrement, so the exit condition is never satisfied. The function then executes indefinitely on the single-threaded Node.js event loop.

Because Node.js processes requests cooperatively, an infinite loop inside any request handler blocks all other pending work. A single malicious input can therefore stall an entire server process. Applications that accept a length parameter from HTTP query strings, JSON bodies, or upstream services and pass it directly to nanoid() or customAlphabet(alphabet)(size) are directly exposed.

Root Cause

The root cause is missing input validation on the size parameter. The non-secure implementation assumes callers supply a non-negative integer. It does not clamp the value, verify its sign, or bound loop iterations. This maps to CWE-835 (Loop with Unreachable Exit Condition, 'Infinite Loop').

Attack Vector

Exploitation requires network access to any endpoint that forwards user-controlled input to the affected functions. No authentication or user interaction is needed. An attacker submits a negative integer where a positive length is expected, and the target process hangs on that request. Repeated requests exhaust available worker threads or process instances behind a load balancer.

text

// Source: https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
// Patch metadata bump in jsr.json distributed with release 5.1.16
 {
   "name": "@sitnik/nanoid",
-  "version": "5.1.15",
+  "version": "5.1.16",
   "license": "MIT",
   "exports": {
     ".": "./index.browser.js",

Source: GitHub Commit 6ccc67b. The patch reaches release 5.1.16, which corrects the loop termination logic in nanoid/non-secure.

Detection Methods for CVE-2026-67214

Indicators of Compromise

Sustained 100% CPU utilization on a single Node.js worker or thread with no corresponding increase in request throughput.
HTTP requests containing negative integer values in length, count, or size parameters sent to endpoints that generate identifiers or tokens.
Request timeouts and health-check failures concentrated on processes that use nanoid/non-secure.
Event-loop lag metrics rising sharply after specific inbound requests.

Detection Strategies

Perform software composition analysis (SCA) on package.json and package-lock.json to identify nanoid versions earlier than 5.1.16.
Add web application firewall (WAF) rules to flag negative integers in parameters that map to length or size fields.
Instrument application code with an event-loop lag monitor and alert on stalls exceeding a defined threshold.

Monitoring Recommendations

Collect per-request CPU time and log requests exceeding expected latency by an order of magnitude.
Aggregate dependency inventory data into a central data lake and query for the vulnerable package version across all services.
Alert on repeated worker restarts triggered by liveness probes, which often indicate a hang-and-recycle loop.

How to Mitigate CVE-2026-67214

Immediate Actions Required

Upgrade nanoid to version 5.1.16 or later in every direct and transitive dependency location.
Audit application code for calls to nanoid/non-secure that accept externally influenced size values and add explicit validation.
Deploy request timeouts and CPU-time limits on Node.js workers to contain hangs while patching is in progress.

Patch Information

The fix ships in nanoid release 5.1.16. See the GitHub Release Note 5.1.16, the upstream commit, and the VulnCheck Security Advisory. Update using npm install nanoid@^5.1.16 or the equivalent command for yarn, pnpm, or jsr.

Workarounds

Validate size parameters at the application boundary and reject any non-positive integer before invoking nanoid functions.
Wrap identifier generation in a helper that coerces size with Math.max(1, Math.floor(Number(size))) and rejects NaN.
Enforce request-level timeouts using AbortController or reverse-proxy timeouts to terminate stalled requests.

bash

# Upgrade nanoid across the project and verify the resolved version
npm install nanoid@^5.1.16
npm ls nanoid

# Yarn / pnpm equivalents
yarn up nanoid@^5.1.16
pnpm update nanoid@^5.1.16