nanoid
6.0.2 · 5 Oct 2026MIT166.7M / weekRepositoryHomepagenpmAtom feed
Security advisories
From OSV, open ones first. Each release line gets its own fix: an older major is fixed by a patch on that major, not by moving to the newest one.
Is your project affected?
Paste your package.json, or type the range you declare for nanoid. It is read in your browser and sent nowhere.
| Line | Newest | Where it stands |
|---|---|---|
| 6.0.2 | No known advisory | |
| 5.1.16 | Safe from 5.1.16 | |
| 4.0.2 | 4 open advisories, worst high · last release Mar 2023, no longer updated | |
| 3.3.20 | Safe from 3.3.18 | |
| 2.1.11 | 16 open advisories, worst high · last release Jan 2020, no longer updated |
- Highnanoid: Integer Overflow or WraparoundGHSA-xwg4-73v4-xw9w · 1 Sep 2026
- 5.x5.0.0 – 5.1.10Fixed in 5.1.11
- 4.x4.0.0 – 4.0.2No fix on 4.x · move to 5.1.11
- 3.x3.0.0 – 3.3.11Fixed in 3.3.12
- 2.x and older0.1.0 – 2.1.11No fix, no longer updated · move to 3.3.12
- Highnanoid: non-secure generators can loop indefinitely with negative sizeGHSA-28wg-ghj8-5hjv · 29 Jul 2026
- 5.x5.0.0 – 5.1.15Fixed in 5.1.16
- 4.x4.0.0 – 4.0.2No fix on 4.x · move to 5.1.16
- 3.x3.0.0 – 3.3.15Fixed in 3.3.16
- 2.x and older0.1.0 – 2.1.11No fix, no longer updated · move to 3.3.16
- Highnanoid: custom generators can loop indefinitely when size is zeroGHSA-2v37-7h3g-55p8 · 29 Jul 2026
- 5.x5.0.0 – 5.1.5Fixed in 5.1.6
- 4.x4.0.0 – 4.0.2No fix on 4.x · move to 5.1.6
- 3.x3.0.0 – 3.3.17Fixed in 3.3.18
- 2.x and older0.1.0 – 2.1.11No fix, no longer updated · move to 3.3.18
- ModeratePredictable results in nanoid generation when given non-integer valuesGHSA-mwcw-c2x4-8c55 · 9 Dec 2024
- 5.x5.0.0 – 5.0.8Fixed in 5.0.9
- 4.x4.0.0 – 4.0.2No fix on 4.x · move to 5.0.9
- 3.x3.0.0 – 3.3.7Fixed in 3.3.8
- 2.x and older0.1.0 – 2.1.11No fix, no longer updated · move to 3.3.8
- ModerateExposure of Sensitive Information to an Unauthorized Actor in nanoidGHSA-qrpm-p2h7-hrv2 · 21 Jan 2022
- 3.x3.0.0 – 3.1.30Fixed in 3.1.31
Registry facts last checked 23 Oct 2026. Releases and advisories last read 23 Oct 2026.