CVE-Katalog

CVE-2026-67214

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an…

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Schweregrad: High · CVSS 8.2CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Published: Jul 29, 2026, 1:32:02 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.33% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Version impact has not been established. The original provider fields are retained below.

Provider details and historical evidence

Original provider fields

{
  "package_releases": [
    {
      "name": "node-mocha",
      "status": "fixed",
      "release": "sid",
      "version": "12.0.3+~cs20.0.13-3"
    },
    {
      "name": "node-mocha",
      "status": "fixed",
      "release": "forky",
      "version": "12.0.3+~cs20.0.13-3"
    },
    {
      "name": "node-mocha",
      "status": "fixed",
      "release": "trixie",
      "version": "10.7.2+ds1+~cs33.1.11-2"
    },
    {
      "name": "node-mocha",
      "status": "fixed",
      "release": "bookworm",
      "version": "10.1.0+ds1+~cs29.3.1-1"
    },
    {
      "name": "node-postcss",
      "status": "fixed",
      "release": "sid",
      "version": "8.5.31+~cs10.2.26-1"
    },
    {
      "name": "node-postcss",
      "status": "fixed",
      "release": "forky",
      "version": "8.5.31+~cs10.2.26-1"
    },
    {
      "name": "node-postcss",
      "status": "vulnerable",
      "release": "trixie",
      "version": "8.4.49+~cs9.2.32-1"
    },
    {
      "name": "node-postcss",
      "status": "vulnerable",
      "release": "bookworm",
      "version": "8.4.20+~cs8.0.23-1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "node-mocha",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "9.1.4+ds1+~cs28.2.8-1"
    },
    {
      "bug": null,
      "name": "node-mocha",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "9.1.4+ds1+~cs28.2.8-1"
    },
    {
      "bug": null,
      "name": "node-mocha",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "9.1.4+ds1+~cs28.2.8-1"
    },
    {
      "bug": null,
      "name": "node-mocha",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "9.1.4+ds1+~cs28.2.8-1"
    },
    {
      "bug": null,
      "name": "node-postcss",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "8.5.15+~cs9.3.39-1"
    },
    {
      "bug": null,
      "name": "node-postcss",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "8.5.15+~cs9.3.39-1"
    },
    {
      "bug": null,
      "name": "node-postcss",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": ""
    },
    {
      "bug": null,
      "name": "node-postcss",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": ""
    }
  ],
  "distribution_packages": [
    {
      "name": "nanoid",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.1.16"
            }
          ]
        }
      ],
      "ecosystem": "npm",
      "fixed_version": "5.1.16",
      "provider_record_id": "GHSA-28WG-GHJ8-5HJV"
    },
    {
      "name": "nanoid",
      "ranges": [
        {
          "type": "SEMVER",
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "5.1.16"
            }
          ]
        }
      ],
      "ecosystem": "npm",
      "fixed_version": "5.1.16"
    },
    {
      "name": "nanoid",
      "ranges": [
        {
          "fixed": "5.1.16",
          "introduced": "4.0.0",
          "last_affected": "",
          "start_excluding": ""
        }
      ],
      "ecosystem": "cpe",
      "fixed_version": "5.1.16",
      "provider_record_id": "NVD-CVE-2026-67214"
    },
    {
      "name": "node-postcss",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "20.04",
      "versions": [
        "6.0.23-1",
        "6.0.23-3"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-67214"
    },
    {
      "name": "node-postcss",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "22.04",
      "versions": [
        "8.2.1+~cs5.3.23-8",
        "8.4.5+~cs7.1.51-2",
        "8.4.6+~cs7.3.21-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-67214"
    },
    {
      "name": "node-postcss",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "24.04",
      "versions": [
        "8.4.20+~cs8.0.23-1",
        "8.4.31+~cs8.0.26-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-67214"
    },
    {
      "name": "node-postcss",
      "distro": "ubuntu",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ],
      "release": "26.04",
      "versions": [
        "8.5.6+~cs9.3.28-1",
        "8.5.8+~cs9.3.30-1"
      ],
      "ecosystem": "deb",
      "fixed_version": "",
      "provider_record_id": "UBUNTU-CVE-2026-67214"
    }
  ]
}

Publisher notes

[trixie] node-postcss: Minor issue [bookworm] node-postcss: Minor issue

OpenFactory catalog packages

Die Paketzuordnung läuft.

[Debian 12 (Bookworm)]

[mocha]Unbekannt
Quellpaket: [node-mocha]
Details (2)
- 10.1.0+ds1+~cs29.3.1-1 · all · bookworm
  Behoben · Behoben: 9.1.4+ds1+~cs28.2.8-1
  nvd · node-mocha · debian · bookworm; nvd · node-mocha · debian · 12
- 10.1.0+ds1+~cs29.3.1-1 · all · bookworm
  Behoben · Behoben: 9.1.4+ds1+~cs28.2.8-1
  nvd · node-mocha · debian · bookworm; nvd · node-mocha · debian · 12
[node-postcss]Unbekannt
Details (2)
- 8.4.20+~cs8.0.23-1+deb12u1 · all · bookworm
  Betroffen
  nvd · node-postcss · debian · bookworm; nvd · node-postcss · debian · 12
- 8.4.20+~cs8.0.23-1+deb12u1 · all · bookworm
  Betroffen
  nvd · node-postcss · debian · bookworm; nvd · node-postcss · debian · 12

[Debian 13 (Trixie)]

[mocha]Unbekannt
Quellpaket: [node-mocha]
Details (2)
- 10.7.2+ds1+~cs33.1.11-2 · all · trixie
  Behoben · Behoben: 9.1.4+ds1+~cs28.2.8-1
  nvd · node-mocha · debian · 13
- 10.7.2+ds1+~cs33.1.11-2 · all · trixie
  Behoben · Behoben: 9.1.4+ds1+~cs28.2.8-1
  nvd · node-mocha · debian · 13
[node-postcss]Unbekannt
Details (2)
- 8.4.49+~cs9.2.32-1 · all · trixie
  Betroffen
  nvd · node-postcss · debian · 13
- 8.4.49+~cs9.2.32-1 · all · trixie
  Betroffen
  nvd · node-postcss · debian · 13

Beobachtet: Oct 25, 2026, 7:24:01 AM UTC

Referenzen

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]