Packages / nanoid / Security

ModerateVulnerabilityGHSA-qrpm-p2h7-hrv2CVE-2021-23566Published 21 Jan 2022

Exposure of Sensitive Information to an Unauthorized Actor in nanoid

Affected releases · nanoid

  • 3.x3.0.0 – 3.1.30Fixed in 3.1.31

On 3.x, the newest line:

npm install nanoid@3.1.31
6.x

  1. Not affected

    6.0.0 – 6.0.2

    3 releases, latest

3.x

  1. Affected

    3.0.0 – 3.1.30

    34 releases

  2. Fixed

    3.1.31 – 3.3.20

    24 releases

135 stable releases of nanoid, oldest to newest, one row per major.

Is your project affected?

Paste your package.json, or type the range you declare for nanoid. It is read in your browser and sent nowhere.

What happens

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.