medium5.5
CVE-2021-23566
Exposure of Sensitive Information to an Unauthorized Actor in nanoid
Impact
The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | nanoid | >= 3.0.0, < 3.1.31 | 3.1.31 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Nanoid Project | Nanoid | from 3.0.0 before 3.1.31 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444
- https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575
- https://github.com/ai/nanoid/pull/328
- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550
- https://snyk.io/vuln/SNYK-JS-NANOID-2332193
- https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
- https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html
- https://github.com/advisories/GHSA-qrpm-p2h7-hrv2
- https://nvd.nist.gov/vuln/detail/CVE-2021-23566