Bug 2514657

Summary:	CVE-2026-73086 goose: nanoid: Predictable ID generation due to integer overflow [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Avinash Hanwate <ahanwate>
Component:	goose	Assignee:	RHEL Lightspeed Maint <rhel-lightspeed>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	rhel-lightspeed, rodolfo.olivieri3, rolivier, rust-sig
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["f391c0c4-346e-455d-8d3d-b73f3d9238a4"]}
Fixed In Version:		Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-09-02 17:36:52 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2514175

Description Avinash Hanwate 2026-08-12 14:27:23 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

Comment 1 Rodolfo Olivieri 2026-09-02 17:36:52 UTC

Goose does not use this library in any of the production code. Since this is a javascript lib, it is mainly used in the webui (desktop) and documentation, and we only ship CLI, which uses a different nanoid package: https://crates.io/crates/nanoid (as it seems, not affected). 

Upstream goose seems to be using versions that are not affected as well, so it should be clear and that is not affecting anyone anywhere. 

* https://github.com/aaif-goose/goose/blob/main/documentation/package-lock.json#L13720 
* https://github.com/aaif-goose/goose/blob/main/ui/pnpm-lock.yaml#L13697