Predictable results in nanoid generation when given non-integer values
Affected releases · nanoid
- 5.x5.0.0 – 5.0.8Fixed in 5.0.9
- 4.x4.0.0 – 4.0.2No fix on this line yet
- 3.x3.0.0 – 3.3.7Fixed in 3.3.8
- 2.x and older0.1.0 – 2.1.11No fix, no longer updated
On 5.x, the newest line:
npm install nanoid@5.0.9Not affected
6.0.0 – 6.0.2
3 releases, latest
Affected
5.0.0 – 5.0.8
9 releases
Fixed
5.0.9 – 5.1.16
18 releases
Affected
4.0.0 – 4.0.2
3 releases
Affected
3.0.0 – 3.3.7
45 releases
Fixed
3.3.8 – 3.3.20
13 releases
Affected
2.0.0 – 2.1.11
17 releases
Affected
1.0.0 – 1.3.4
22 releases
Affected
0.1.0 – 0.2.2
5 releases
Is your project affected?
Paste your package.json, or type the range you declare for nanoid. It is read in your browser and sent nowhere.
What happens
When nanoid is called with a fractional value, there were a number of undesirable effects:
in browser and non-secure, the code infinite loops on while (size--)
in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
if the first call in node is a fractional argument, the initial buffer allocation fails with an error
Version 3.3.8 and 5.0.9 are fixed.