CVE-2026-67213 describes an algorithmic denial of service vulnerability in the nanoid library, a small, secure, URL-friendly unique string ID generator. When the customAlphabet or customRandom functions receive a zero-size input, the internal generation loop never meets its termination condition, causing an infinite loop. This leads to 100% CPU consumption and blocks the event loop in Node.js or browser contexts, effectively causing a denial of service. The vulnerability is present in Red Hat Hardened Images and Red Hat Ansible Automation Platform 2.2, among other affected products. Red Hat has published advisories detailing the issue and recommends validating inputs to prevent zero-size parameters. No official fix or patch is explicitly stated in the advisory content provided.

The vulnerability causes a denial of service by infinite looping when zero-size inputs are passed to nanoid's customAlphabet or customRandom functions. This results in the affected application's thread hanging and CPU utilization spiking to 100%, blocking event loop execution and degrading service availability. There is no impact on confidentiality or integrity reported.

Red Hat advises validating the size parameter passed to nanoid's customAlphabet or customRandom functions to reject or sanitize zero-value inputs before they reach the nanoid library. No official patch or update is explicitly provided in the advisory content. Users should apply input validation in their application code to mitigate this issue.