CVE-2026-73086 nanoid: Integer Overflow or Wraparound
An integer overflow in nanoid allows attackers to force deterministic ID generation, compromising session tokens and API keys in JavaScript applications.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-73086?
CVE-2026-73086 is a high-severity vulnerability in ai nanoid, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
Weakness: CWE-190
Which versions are affected by CVE-2026-73086?
4 open source packages ship an affected version, including nanoid.
| Package | Affected | Fixed in |
|---|---|---|
nanoid npm | All versions | 3.3.12 |
nanoid npm | All versions | 3.3.12 |
nanoid npm | From 4.0.0 | 5.1.11 |
nanoid npm | From 4.0.0 | 5.1.11 |
Linux distribution packages (1)
grafana13.1 Red Hat:hummingbird:1 | All versions | 0:13.1.3-0.1.hum1 |
How do I fix CVE-2026-73086?
Upgrade nanoid to a fixed version for your release line: 3.3.12 or 5.1.11.
Is CVE-2026-73086 being exploited?
There is no known exploitation of CVE-2026-73086 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-HR55516, CLSA-2026-1791806697, CLSA-2026-1792139111, CLSA-2026-1792231734, CLSA-2026-1792231838, CLSA-2026-1792231931 and 23 more.