{"answers":{"affected":"4 open source packages ship an affected version, including nanoid.","exploited":"There is no known exploitation of CVE-2026-73086 in the wild and no public exploit code.","fix":"Upgrade nanoid to a fixed version for your release line: 3.3.12 or 5.1.11.","what":"CVE-2026-73086 is a high-severity vulnerability in ai nanoid, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-73086 and fix it if it is affected.\n\nWhat it is: CVE-2026-73086 is a high-severity vulnerability in ai nanoid, published on 11 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-73086 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- nanoid (npm): affected all versions; fixed in 3.3.12\n- nanoid (npm): affected all versions; fixed in 3.3.12\n- nanoid (npm): affected from 4.0.0; fixed in 5.1.11\n- nanoid (npm): affected from 4.0.0; fixed in 5.1.11\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-73086/ (Markdown: https://insights.sbomify.com/CVE-2026-73086/index.md)","id":"CVE-2026-73086","markdown":"https://insights.sbomify.com/CVE-2026-73086/index.md","name":"CVE-2026-73086","record":{"aliases":["CLEANSTART-2026-HR55516","CLSA-2026-1791806697","CLSA-2026-1792139111","CLSA-2026-1792231734","CLSA-2026-1792231838","CLSA-2026-1792231931","DEBIAN-CVE-2026-73086","ECHO-bc75-657e-24f9","GHSA-xwg4-73v4-xw9w","MINI-4ph7-g2x6-33r6","MINI-69v9-7xwg-vf2h","MINI-8j4c-wp4r-jg25","MINI-f5gv-cpwv-rv96","MINI-frjg-27vg-xvxr","MINI-grcg-6jxv-h83g","MINI-j2v3-5fh2-c6hv","MINI-j9h9-jh67-g5q3","MINI-jmq7-xm5x-66ww","MINI-jqq8-ccr8-3rf6","MINI-mh55-98j7-4jm6","MINI-q2hm-7qwx-49v2","MINI-r7fm-f9fr-7mf7","MINI-rwf6-x7xx-vhpw","MINI-vcr7-f886-j7wf","MINI-vrc7-wxgx-xjjv","MINI-x27c-xgf2-3f2v","RHSA-2026:54412","ROOT-APP-NPM-CVE-2026-73086","UBUNTU-CVE-2026-73086"],"analysis":{"component_type":"library","fix_type":"upgrade","impacts":["security_bypass","data_read"],"network_reachable":"yes","non_default_config":false,"product_category":"JavaScript ID generator","requires_auth":"none","summary":"An integer overflow in nanoid allows attackers to force deterministic ID generation, compromising session tokens and API keys in JavaScript applications.","user_interaction":"not_required","vuln_class":"integer_overflow"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":7.4,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-190","name":"Integer Overflow or Wraparound"}],"description":"nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.","ecosystems":["Red Hat:hummingbird:1","npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"nanoid: Integer Overflow or Wraparound","id":"CVE-2026-73086","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"integer_overflow","year":"2026"},"n_packages":5,"n_references":6,"next":{"headline":"Dozzle: SSRF guard bypass via IPv6 transition addresses (6to4/NAT64/Teredo) in webhook notification dispatcher","id":"CVE-2026-73087"},"packages":[{"ecosystem":"npm","fixed":["3.3.12"],"introduced":["0"],"last_affected":[],"package":"nanoid","purl":null,"source":"GHSA-xwg4-73v4-xw9w"},{"ecosystem":"npm","fixed":["3.3.12"],"introduced":["0"],"last_affected":[],"package":"nanoid","purl":"pkg:npm/nanoid","source":"GHSA-xwg4-73v4-xw9w"},{"ecosystem":"npm","fixed":["5.1.11"],"introduced":["4.0.0"],"last_affected":[],"package":"nanoid","purl":null,"source":"GHSA-xwg4-73v4-xw9w"},{"ecosystem":"npm","fixed":["5.1.11"],"introduced":["4.0.0"],"last_affected":[],"package":"nanoid","purl":"pkg:npm/nanoid","source":"GHSA-xwg4-73v4-xw9w"},{"ecosystem":"Red Hat:hummingbird:1","fixed":["0:13.1.3-0.1.hum1"],"introduced":["0"],"last_affected":[],"package":"grafana13.1","purl":"pkg:rpm/redhat/grafana13.1","source":"RHSA-2026:54412"}],"prev":{"headline":"Audiobookshelf: Refresh Token Accepted on Resource Endpoints","id":"CVE-2026-73085"},"products":["nanoid"],"published":"2026-08-11","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Red Hat","prefix":"RHSA"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-08-12","vendors":["ai"]},"summary":"An integer overflow in nanoid allows attackers to force deterministic ID generation, compromising session tokens and API keys in JavaScript applications.","url":"https://insights.sbomify.com/CVE-2026-73086/"}