Integer overflow in nanoid - CVE-2026-73086
Published: September 16, 2026
Vulnerability identifier: #VU150176
CSH Severity: Medium
CVSS v4: 9.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-73086
CWE-ID: CWE-190
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to predict generated identifiers and bypass authentication.
The vulnerability exists due to integer overflow or wraparound in the nanoid(size) function when processing a user-controlled size parameter. A remote attacker can submit a size value of at least 2^31 to corrupt the process-wide CSPRNG pool and predict subsequently generated tokens.
The issue affects all consumers of nanoid in the same process until the process restarts or the pool offset wraps back to a positive value.
Affected software
nanoid
Crowd Data Center
Confluence Data Center
Bitbucket Data Center
Jira Software Data Center
Crowd Data Center
Confluence Data Center
Bitbucket Data Center
Jira Software Data Center
How to mitigate CVE-2026-73086
Install security update from vendor's website.
nanoid - addressed in versions 3.3.12, 5.1.11
Crowd Data Center - update to 7.2.2
Confluence Data Center - addressed in versions 9.2.22, 10.2.15
Bitbucket Data Center - addressed in versions 9.4.22, 10.2.6, 10.4.2
Jira Software Data Center - addressed in versions 10.3.25, 11.3.8
Crowd Data Center - update to 7.2.2
Confluence Data Center - addressed in versions 9.2.22, 10.2.15
Bitbucket Data Center - addressed in versions 9.4.22, 10.2.6, 10.4.2
Jira Software Data Center - addressed in versions 10.3.25, 11.3.8