chore(deps): update dependency nanoid to v5.1.16 [security] by renovate[bot] · Pull Request #133 · promptfoo/crabcode

renovate · 2026-08-09T21:05:57Z

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid	`5.1.11` → `5.1.16`

Predictable results in nanoid generation when given non-integer values

CVE-2024-55565 / GHSA-mwcw-c2x4-8c55

More information

Details

When nanoid is called with a fractional value, there were a number of undesirable effects:

in browser and non-secure, the code infinite loops on while (size--)
in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

Severity

CVSS Score: 4.3 / 10 (Medium)
Vector String: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

nanoid: custom generators can loop indefinitely when size is zero

CVE-2026-67213 / GHSA-2v37-7h3g-55p8

More information

Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

nanoid: non-secure generators can loop indefinitely with negative size

CVE-2026-67214 / GHSA-28wg-ghj8-5hjv

More information

Details

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Severity

CVSS Score: 8.2 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

nanoid: Integer Overflow or Wraparound

CVE-2026-73086 / GHSA-xwg4-73v4-xw9w

More information

Details

Summary

An integer overflow in nanoid(size) permanently corrupts the process-wide CSPRNG pool, causing all subsequent ID generation to return the deterministic string "uuuuuuuuuuuuuuuuuuuuu". Any application that passes user-influenced values to the size parameter loses all randomness guarantees for session tokens, CSRF tokens, and unique identifiers until process restart.

Details

nanoid() at index.js:101 coerces the size parameter with size |= 0, which converts it to a signed 32-bit integer. When size >= 2^31 (e.g., 2147483648), this wraps to -2147483648.

The negative value is passed to fillPool() (index.js:15):

function fillPool(bytes) {
  if (!pool || pool.length < bytes) {       // false: pool exists, -2B < pool.length
    pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER)
    crypto.getRandomValues(pool)
    poolOffset = 0
  } else if (poolOffset + bytes > pool.length) {  // false: poolOffset + (-2B) < pool.length
    crypto.getRandomValues(pool)
    poolOffset = 0
  }
  poolOffset += bytes  // poolOffset += -2147483648 → deeply negative
}

Neither branch triggers, so the pool is never refreshed. poolOffset becomes ~-2.1 billion.

Subsequent nanoid() calls execute:

for (let i = poolOffset - size; i < poolOffset; i++) {
  id += scopedUrlAlphabet[pool[i] & 63]
}

pool[negative_index] returns undefined. undefined & 63 evaluates to 0. urlAlphabet[0] is 'u'. Every ID becomes "uuuuuuuuuuuuuuuuuuuuu".

The corruption is persistent — it affects all subsequent calls in the process until ~100 million calls eventually wrap poolOffset back to positive, or the process restarts.

PoC

import { nanoid } from 'nanoid'

// Step 1: Normal operation
console.log(nanoid())  // e.g., "V1StGXR8_Z5jdHi6B-myT"

// Step 2: Trigger overflow (e.g., from an API parameter)
try { nanoid(2147483648) } catch(e) {}

// Step 3: All subsequent IDs are deterministic
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
console.log(nanoid())  // "uuuuuuuuuuuuuuuuuuuuu"
// ... forever, process-wide

Run with: node --experimental-vm-modules poc.mjs

Attack scenario: Any API endpoint that accepts a user-controlled length/size parameter (URL shortener slug length, configurable token size, etc.) and passes it to nanoid(userInput).

Impact

Complete loss of ID unpredictability and uniqueness, process-wide, from a single request.

All session IDs, CSRF tokens, API keys, and database identifiers generated after the attack are identical and predictable
An attacker can predict all tokens issued to other users, enabling session hijacking and authentication bypass
The corruption is persistent (survives across requests) and affects all consumers of nanoid in the same process
No special privileges or preconditions required — a single unauthenticated request is sufficient
Affects any application that passes external input to the size parameter without validation

Severity

CVSS Score: 7.4 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

ai/nanoid (nanoid)

`v5.1.16`

Compare Source

Fixed forever loop on negative size (by @spokodev).

`v5.1.15`

Compare Source

Fixed random pool corruption on big ID sizes.

`v5.1.14`

Compare Source

Fixed npm package size regression.

`v5.1.13`

Compare Source

Fixed npm package size regression.

`v5.1.12`

Compare Source

Moved to npm Provenance and Staged Publishing.

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Compatibility and validation

The Draw server uses the secure Nano ID ESM export with a fixed six-character suffix. Upstream 5.1.11→5.1.16 fixes random-pool error recovery and a non-secure negative-size loop; the existing session-ID contract remains compatible. The manifest now requires at least 5.1.16 as well as the lockfile upgrade.

Added offline session-ID/storage tests and Node 20/22/24 server/test/UI-build CI, preserving Bats and Shellcheck and including Draw in the required aggregate. Validation also exposed an existing UI npm ci failure on Node 20/npm 10: extraneous Android watcher entries caused EBADPLATFORM. This reproduces on unchanged main. Normal lockfile regeneration prunes 19 entries already marked extraneous; every retained package record, version, integrity and platform constraint is unchanged.

Validation passed on Node 20.20.2, 22.23.2 and 24.21.0: reproducible server/UI installs, TypeScript/Vite builds, both session tests, and actual Draw CLI start/serve/save/list/delete smoke with a local fixture, disabled tunnel, and mocked browser. All 39 Bats tests and CI-equivalent Shellcheck also pass. Existing unrelated transitive audit findings remain in engine.io, socket.io-adapter, socket.io-parser and ws; no audit/security gate was removed.

…sions

renovate · 2026-09-16T03:30:38Z

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.

chatgpt-codex-connector · 2026-09-16T03:30:46Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T03:34:00.665100Z	`4298633`	Manual request
🔒 Security Review	✅ Completed 2026-09-16T03:34:22.501605Z	`4298633`	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

mldangelo-oai · 2026-09-16T03:31:10Z

@codex review

mldangelo-oai · 2026-09-16T03:31:13Z

@codex security review

chatgpt-codex-connector · 2026-09-16T03:33:59Z

Codex Review: Didn't find any major issues. 👍

Reviewed commit: 42986336ee

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-09-16T03:34:21Z

🛡️ Codex Security Review

Security review completed. No security issues were found in this pull request.

Reviewed commit: 42986336ee

View security finding report

Only the user who started this review can view the report in Codex.

ℹ️ About Codex security reviews in GitHub

This is an experimental Codex feature. Security reviews are triggered when:

You comment "@codex security review"
A regular code review gets triggered (for example, "@codex review" or when a PR is opened), and you’re opted in so security review runs alongside code review

Once complete, Codex will leave suggestions, or a comment if no findings are found.

renovate Bot force-pushed the renovate/npm-nanoid-vulnerability branch from 41fe2e8 to 42dd066 Compare September 2, 2026 23:52

chore(deps): update dependency nanoid to v5.1.16 [security]

23970a4

renovate Bot force-pushed the renovate/npm-nanoid-vulnerability branch from 42dd066 to 23970a4 Compare September 7, 2026 16:32

fix(deps): validate secure Draw session IDs across supported Node ver…

4298633

…sions

mldangelo-oai merged commit 38fbf84 into main Sep 16, 2026
10 checks passed

mldangelo-oai deleted the renovate/npm-nanoid-vulnerability branch September 16, 2026 03:36

Navigation Menu

Uh oh!

chore(deps): update dependency nanoid to v5.1.16 [security] - #133

chore(deps): update dependency nanoid to v5.1.16 [security]#133
mldangelo-oai merged 2 commits into
mainfrom
renovate/npm-nanoid-vulnerability

renovate Bot commented Aug 9, 2026 •

edited by mldangelo-oai

Loading

Uh oh!

renovate Bot commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026 •

edited

Loading

Uh oh!

mldangelo-oai commented Sep 16, 2026

Uh oh!

mldangelo-oai commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

renovate Bot commented Aug 9, 2026 • edited by mldangelo-oai Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Predictable results in nanoid generation when given non-integer values

Details

Severity

References

nanoid: custom generators can loop indefinitely when size is zero

Details

Severity

References

nanoid: non-secure generators can loop indefinitely with negative size

Details

Severity

References

nanoid: Integer Overflow or Wraparound

Details

Summary

Details

PoC

Impact

Severity

References

Release Notes

v5.1.16

v5.1.15

v5.1.14

v5.1.13

v5.1.12

Configuration

Compatibility and validation

Uh oh!

renovate Bot commented Sep 16, 2026

Edited/Blocked Notification

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

mldangelo-oai commented Sep 16, 2026

Uh oh!

mldangelo-oai commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

Uh oh!

chatgpt-codex-connector Bot commented Sep 16, 2026

🛡️ Codex Security Review

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

renovate Bot commented Aug 9, 2026 •

edited by mldangelo-oai

Loading

`v5.1.16`

`v5.1.15`

`v5.1.14`

`v5.1.13`

`v5.1.12`

chatgpt-codex-connector Bot commented Sep 16, 2026 •

edited

Loading