Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-11 | 1 | Disclosure1 |
| 2026-08-12 | 1 | Patch1 |
| 2026-09-01 | 1 | Disclosure1 |
🔴 nanoid (#JavaScript), Integer Overflow (CWE-190), #CVE-2026-73086 (High) -DC-Sep2026-2066 https://dailycve.com/nanoid-javascript-integer-overflow-cwe-190-cve-2026-73086-high-dc-sep2026-2066/
Post summary
The post announces a high‑severity integer overflow vulnerability (CVE‑2026‑73086) in the JavaScript nanoid library, including its CWE classification but lacking any PoC, exploit, or mitigation details.
🚨High - nanoid Integer Overflow Corrupts CSPRNG, Producing Predictable IDs (CVE-2026-73086) In nanoid before 3.3.12 and 4.0.0-5.1.10, the nanoid(size) function coerces the size parameter to a signed 32-bit integer. A value of 2147483648 wraps to -2147483648 and corrupts the process-wide CSPRNG poolOffset in fillPool(). After that, every generated value, including session tokens, CSRF tokens, API keys, and unique IDs, becomes the fixed string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. There's no crash or code execution, but predictable security tokens can lead to session and account compromise. It only triggers if an app passes an attacker-influenced size to nanoid(). CVSS 7.4. 👉Upgrade nanoid to 3.3.12 or 5.1.11.
Post summary
Vulnerability in nanoid causes predictable ID generation via integer overflow; no crash but leads to token prediction. Upgrading to 3.3.12 or 5.1.11 mitigates the issue.
CVE-2026-73086 nanoid Deterministic ID Generation Due to Size Parameter Coercion https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-73086
Post summary
The entry announces a new vulnerability, CVE‑2026‑73086, affecting nanoid’s deterministic ID generation via size parameter coercion, but provides no evidence of exploitation, patch status, or PoC.