High 7.4Published Aug 11, 2026

CVE-2026-73086nanoid: Integer Overflow or Wraparound

Updated under an hour ago (2026-10-19 07:50 UTC)

Does this affect you?

It affects ai nanoid. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for ai nanoid

Exploited in the last 30 days

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

CVSS: 7.4 HIGH (v3.1, CNA)CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness (CWE): CWE-190
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: GitHub_M
NVD analysis: Deferred
Record last updated: Aug 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

ai nanoid ai:nanoid (from the name)	before 3.3.12; from 4.0.0, < 5.1.11	CNA record

References

https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9wx-refsource-confirm
https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4x-refsource-misc
https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3x-refsource-misc
https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202acx-refsource-misc
https://github.com/ai/nanoid/releases/tag/3.3.12x-refsource-misc
https://github.com/ai/nanoid/releases/tag/5.1.11x-refsource-misc

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.