VDB

RHSA-2026:54412

RHSA-2026:54412 PUBLISHED CVSS 7.400000095367432 HIGH

A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.

Risk Scores

CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

Affected Products

VendorProductVersions
Red Hatgrafana13-1-main@src as a component of Red Hat Hardened Images*
Red Hatgrafana13-1-main@x86_64 as a component of Red Hat Hardened Images*
Red Hatgrafana13-1-main@aarch64 as a component of Red Hat Hardened Images*

Timeline

  • Aug 12, 2026 CVE Published
  • Aug 25, 2026 CVE Updated
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Distribution Patch
  • Aug 25, 2026 Security Advisory
  • Aug 25, 2026 Security Advisory

References

Open in Interactive Console →
$ Console Community · 50/day Open console ›