nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
Weakness
The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Red Hat Hardened Images | RedHat | jaeger-main-2.20.0-0.6.hum1 | * |
| Red Hat Hardened Images | RedHat | grafana12-4-main-12.4.6-0.2.hum1 | * |
| Red Hat Hardened Images | RedHat | grafana13-1-main-13.1.1-0.3.hum1 | * |
| Node-postcss | Ubuntu | upstream | * |