CyberRota Analysis
AI-GeneratedThe vulnerability affects the nanoid library versions prior to 5.1.6, specifically in the customAlphabet and customRandom functions, which can enter an infinite loop when provided with a size parameter of 0. This flaw can lead to a denial-of-service condition, causing the application to hang indefinitely if an attacker manipulates the input. Developers and organizations using this library should prioritize updating to the latest version to mitigate potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Related CVEs
Other vulnerabilities affecting the same vendor(s)