VDB

CVE-2026-73086

CVE-2026-73086 PUBLISHED CVSS 7.4 HIGH

Reported by GitHub_M · Published August 11, 2026

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

Risk Scores

CVSS 3.1
7.4
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
ainanoid< 3.3.12, >= 4.0.0, < 5.1.11
ainanoid< 3.3.12, >= 4.0.0, < 5.1.11, < 3.3.12

Timeline

  • Aug 11, 2026 CVE Published
  • Aug 12, 2026 Coalition ESS Score
  • Aug 12, 2026 CVE Updated
  • Aug 16, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 100/wk Open console ›