CVE-2026-73086: CWE-190: Integer Overflow or Wraparound in ai nanoid
CVE-2026-73086 is an integer overflow vulnerability in the ai nanoid JavaScript library. The nanoid(size) function improperly coerces the size parameter to a signed 32-bit integer, allowing a large input value to wrap around and corrupt the process-wide cryptographically secure pseudorandom number generator (CSPRNG) state. This corruption causes subsequent generated tokens and identifiers to become a deterministic, fixed string until the process restarts. The issue is fixed in versions 3.3.12 and 5.1.11.
AI Analysis
Technical Summary
The vulnerability in ai nanoid occurs because the size parameter passed to the nanoid(size) function is coerced to a signed 32-bit integer. When a value such as 2147483648 is provided, it wraps around to -2147483648, corrupting the CSPRNG poolOffset in fillPool(). This results in the generation of predictable, deterministic strings ("uuuuuuuuuuuuuuuuuuuuu") for session tokens, CSRF tokens, API keys, and unique identifiers until the process restarts. This undermines the randomness and security guarantees of the library. The flaw affects versions prior to 3.3.12 and 5.1.11, where it has been fixed.
Potential Impact
The vulnerability causes the cryptographically secure random number generator state to become corrupted, leading to predictable token and identifier generation. This compromises the confidentiality and integrity of session tokens, CSRF tokens, API keys, and unique identifiers, potentially allowing attackers to predict or reuse these values. The impact is high confidentiality and integrity loss but does not affect availability. The issue persists until the affected process is restarted.
Mitigation Recommendations
This vulnerability is fixed in ai nanoid versions 3.3.12 and 5.1.11. Users should upgrade to these or later versions to remediate the issue. No other mitigation or workaround is indicated. Patch status is confirmed by the version fix information in the description.
CVE-2026-73086: CWE-190: Integer Overflow or Wraparound in ai nanoid
Description
CVE-2026-73086 is an integer overflow vulnerability in the ai nanoid JavaScript library. The nanoid(size) function improperly coerces the size parameter to a signed 32-bit integer, allowing a large input value to wrap around and corrupt the process-wide cryptographically secure pseudorandom number generator (CSPRNG) state. This corruption causes subsequent generated tokens and identifiers to become a deterministic, fixed string until the process restarts. The issue is fixed in versions 3.3.12 and 5.1.11.
CVSS v3.1
Score 7.4high
Affected software
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in ai nanoid occurs because the size parameter passed to the nanoid(size) function is coerced to a signed 32-bit integer. When a value such as 2147483648 is provided, it wraps around to -2147483648, corrupting the CSPRNG poolOffset in fillPool(). This results in the generation of predictable, deterministic strings ("uuuuuuuuuuuuuuuuuuuuu") for session tokens, CSRF tokens, API keys, and unique identifiers until the process restarts. This undermines the randomness and security guarantees of the library. The flaw affects versions prior to 3.3.12 and 5.1.11, where it has been fixed.
Potential Impact
The vulnerability causes the cryptographically secure random number generator state to become corrupted, leading to predictable token and identifier generation. This compromises the confidentiality and integrity of session tokens, CSRF tokens, API keys, and unique identifiers, potentially allowing attackers to predict or reuse these values. The impact is high confidentiality and integrity loss but does not affect availability. The issue persists until the affected process is restarted.
Mitigation Recommendations
This vulnerability is fixed in ai nanoid versions 3.3.12 and 5.1.11. Users should upgrade to these or later versions to remediate the issue. No other mitigation or workaround is indicated. Patch status is confirmed by the version fix information in the description.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-10T19:37:41.445Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a7b5843bf8831d539156a93
Added to database: 08/11/2026, 17:13:39 UTC
Last enriched: 08/11/2026, 17:26:12 UTC
Last updated: 08/11/2026, 17:26:12 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.