{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/nanoid--4.0.0--5.1.11/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:nanoid_project:nanoid:*:*:*:*:*:node.js:*:*"],"_cs_cves":[{"cvss":7.4,"id":"CVE-2026-73086"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["nanoid (\u003c 3.3.12)","nanoid (\u003e= 4.0.0, \u003c 5.1.11)"],"_cs_severities":["high"],"_cs_tags":["supply-chain","vulnerability","remote-code-execution"],"_cs_type":"advisory","_cs_vendors":["ai"],"content_html":"\u003cp\u003eThe popular npm package \u003ccode\u003enanoid\u003c/code\u003e contains an integer overflow vulnerability (CVE-2026-73086) that can be triggered when a user-controlled value is passed to the \u003ccode\u003enanoid(size)\u003c/code\u003e function. Specifically, supplying a size value greater than or equal to 2^31 triggers a bitwise OR operation (\u003ccode\u003esize |= 0\u003c/code\u003e) that causes the value to wrap into a negative signed 32-bit integer. This negative value bypasses the library's CSPRNG pool-refill logic, causing the internal \u003ccode\u003epoolOffset\u003c/code\u003e to point to an invalid memory index. Subsequent ID generation calls fail to retrieve entropy and instead read \u003ccode\u003eundefined\u003c/code\u003e from the buffer, resulting in a permanent corruption of the ID generation stream. Every ID produced thereafter becomes the deterministic string \u0026quot;uuuuuuuuuuuuuuuuuuuuu\u0026quot;. This corruption persists process-wide until the application restarts or ~100 million additional IDs are generated. Because \u003ccode\u003enanoid\u003c/code\u003e is commonly used for security-critical identifiers such as session tokens and CSRF tokens, this vulnerability allows for trivial session hijacking and authentication bypass across the affected application.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker identifies an API endpoint or application feature that accepts a user-provided integer to determine ID length (e.g., a \u0026quot;token size\u0026quot; or \u0026quot;identifier length\u0026quot; parameter).\u003c/li\u003e\n\u003cli\u003eAttacker sends a crafted request containing a value greater than or equal to 2,147,483,648 (0x80000000).\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003enanoid\u003c/code\u003e library's \u003ccode\u003eindex.js\u003c/code\u003e performs \u003ccode\u003esize |= 0\u003c/code\u003e on the malicious input, causing an integer overflow to -2,147,483,648.\u003c/li\u003e\n\u003cli\u003eThe library passes the negative integer to the \u003ccode\u003efillPool()\u003c/code\u003e function, which fails to trigger the entropy refresh logic due to the negative index arithmetic.\u003c/li\u003e\n\u003cli\u003eThe internal \u003ccode\u003epoolOffset\u003c/code\u003e is updated to a deeply negative value, corrupting the subsequent ID generation loop.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003enanoid\u003c/code\u003e function attempts to read from the corrupted pool index, receives \u003ccode\u003eundefined\u003c/code\u003e, and maps the resulting bitwise operation to the static character 'u'.\u003c/li\u003e\n\u003cli\u003eThe application returns a deterministic \u0026quot;uuuu...\u0026quot; ID to the user, confirming successful exploitation.\u003c/li\u003e\n\u003cli\u003eAttacker leverages the predictable ID stream to predict future session tokens or forge identifiers for other users, leading to full account takeover or session hijacking.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in a complete loss of unpredictability and uniqueness for all identifiers generated by the affected process. This includes session tokens, CSRF tokens, API keys, and database primary keys. An attacker can predict tokens issued to other users, leading to widespread session hijacking and authentication bypass. The vulnerability is highly impactful because the corruption is persistent for the entire process lifetime and requires only a single unauthenticated request.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade \u003ccode\u003enanoid\u003c/code\u003e to version 3.3.12 or 5.1.11 (or later) immediately to incorporate input validation that prevents the integer overflow.\u003c/li\u003e\n\u003cli\u003eAudit all application code paths that pass user-supplied input to the \u003ccode\u003enanoid()\u003c/code\u003e function and implement strict server-side validation to ensure the \u003ccode\u003esize\u003c/code\u003e parameter stays within reasonable, positive bounds.\u003c/li\u003e\n\u003cli\u003eDeploy monitoring to alert on application process crashes or abnormal token generation patterns that indicate the process may have been subjected to an exploitation attempt.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-02T00:01:00Z","date_published":"2026-09-02T00:01:00Z","id":"https://feed.craftedsignal.io/briefs/2026-09-nanoid-overflow/","summary":"An integer overflow in the nanoid library allows unauthenticated attackers to permanently corrupt the process-wide CSPRNG pool, forcing all subsequent ID generation to output a deterministic string and enabling mass authentication bypass.","title":"Integer Overflow Vulnerability in nanoid Leads to Deterministic Token Generation","url":"https://feed.craftedsignal.io/briefs/2026-09-nanoid-overflow/"}],"language":"en","title":"CraftedSignal Threat Feed - Nanoid (\u003e= 4.0.0, \u003c 5.1.11)","version":"https://jsonfeed.org/version/1.1"}