npm

nanoid

Security advisories for nanoid, newest first. 3 known, all fixed. If you’re on 5.1.16 or later, none of them affect you.

RSS feed Check your lock file →

Latest version

6.0.2

Advisories

3 · 0 unfixed

Last advisory

1 Sep 2026

Safe from

5.1.16

3 advisories · newest first

HIGH7.4 1 Sep 2026

nanoid: Integer Overflow or Wraparound

GHSA-xwg4-73v4-xw9w · CVE-2026-73086

Affected

< 3.3.12 ≥ 4.0.0, < 5.1.11

Fixed in

3.3.12 5.1.11

Published

1 Sep 2026

HIGH5.9 29 Jul 2026

nanoid: custom generators can loop indefinitely when size is zero

GHSA-2v37-7h3g-55p8 · CVE-2026-67213

Affected

< 3.3.18 ≥ 4.0.0, < 5.1.6

Fixed in

3.3.18 5.1.6

Published

29 Jul 2026

HIGH5.9 29 Jul 2026

nanoid: non-secure generators can loop indefinitely with negative size

GHSA-28wg-ghj8-5hjv · CVE-2026-67214

Affected

< 3.3.16 ≥ 4.0.0, < 5.1.16

Fixed in

3.3.16 5.1.16

Published

29 Jul 2026

/advisories/npm/nanoid/feed.rss

From the GitHub advisory database, via OSV · synced hourly

Know when your sites are affected.

Porro reads composer.lock and package-lock from every site on your care plans and puts the ones that need you at the top. Updates arrive as pull requests.

Start your free trial →