Bug 2514175 (CVE-2026-73086) - CVE-2026-73086 nanoid: nanoid: Predictable ID generation due to integer overflow
Summary: CVE-2026-73086 nanoid: nanoid: Predictable ID generation due to integer overflow
Keywords:
Status: NEW
Alias: CVE-2026-73086
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2514650 2514651 2514652 2514653 2514654 2514655 2514656 2514657 2514658 2514659 2514664 2514667 2514668 2514669 2514670 2514671 2514672 2514674 2514675 2514676 2514679 2514680 2514681 2514683 2514684 2514685 2514686 2514687 2514688 2514694 2514702 2514707 2514716 2514717 2514718 2514719 2514661 2514673 2514677 2514678 2514682 2514689 2514711
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-11 17:12 UTC by OSIDB Bzimport
Modified: 2026-08-15 08:27 UTC (History)
135 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-08-11 17:12:08 UTC 
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Note You need to log in before you can comment on or make changes to this bug.