VDB
RHSA-2026:54520
RHSA-2026:54520
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in nanoid, a JavaScript library for generating unique string IDs. A remote attacker could exploit an integer overflow vulnerability by providing a specific input to the `nanoid(size)` function. This issue causes the internal random number generator to become predictable, leading to the generation of identical identifiers for session tokens, security tokens (Cross-Site Request Forgery (CSRF) tokens), and API keys. Such predictability could allow an attacker to bypass security measures that rely on unique and random identifiers.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | prometheus3-5-main@aarch64 as a component of Red Hat Hardened Images | * |
| Red Hat | prometheus3-5-main@x86_64 as a component of Red Hat Hardened Images | * |
| Red Hat | prometheus3-5-main@src as a component of Red Hat Hardened Images | * |
Timeline
- Aug 13, 2026 CVE Published
- Sep 2, 2026 CVE Updated
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Distribution Patch
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
- Sep 2, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:54520 advisory
- https://access.redhat.com/security/cve/CVE-2026-73086 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://images.redhat.com/ advisory
- https://access.redhat.com/security/cve/CVE-2026-73646 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_54520.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2514175 issue
- https://www.cve.org/CVERecord?id=CVE-2026-73086 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73086 advisory
- https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4 advisory
- https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3 advisory
- https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac advisory
- https://github.com/ai/nanoid/releases/tag/3.3.12 advisory
- https://github.com/ai/nanoid/releases/tag/5.1.11 advisory
- https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2517456 issue
- https://www.cve.org/CVERecord?id=CVE-2026-73646 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73646 advisory
- https://github.com/postcss/postcss/commit/95663d3eb7ba26f4854dd19d3b4f4425760cf56c advisory
- https://github.com/postcss/postcss/releases/tag/8.5.18 advisory
…and 1 more