SB2026091625 - Integer overflow in nanoid

Description

This security bulletin contains information about 1 vulnerability.

1) Integer overflow (CVE-ID: CVE-2026-73086)

CWE-ID: CWE-190 - Integer overflow

CVSSv4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to predict generated identifiers and bypass authentication.

The vulnerability exists due to integer overflow or wraparound in the nanoid(size) function when processing a user-controlled size parameter. A remote attacker can submit a size value of at least 2^31 to corrupt the process-wide CSPRNG pool and predict subsequently generated tokens.

The issue affects all consumers of nanoid in the same process until the process restarts or the pool offset wraps back to a positive value.

Remediation

Install update from vendor's website.

References

• https://github.com/advisories/GHSA-xwg4-73v4-xw9w
• https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4