GHSA-xwg4-73v4-xw9w: nanoid: Integer Overflow or Wraparound
Summary
A flaw in the nanoid library causes an integer overflow (a calculation error where a number wraps around to an unexpected value) when the size parameter exceeds 2^31, permanently breaking the random number generator for the entire process and making all generated IDs return the identical string "uuuuuuuuuuuuuuuuuuuuu". This allows attackers to predict session tokens, CSRF tokens (data that prevents forged requests), and other security-critical identifiers by passing a large user-controlled value to the size parameter, which persists until the process restarts.
Vulnerability Details
EPSS: 0.3%
Yes
September 1, 2026
Classification
Affected Packages
Related Issues
Original source: https://github.com/advisories/GHSA-xwg4-73v4-xw9w
First tracked: September 1, 2026 at 08:01 PM
Classified by LLM (prompt v3) · confidence: 75%