{"id":"CVE-2024-55565","aliases":["GHSA-mwcw-c2x4-8c55"],"url":"https://o3.security/vulnerability/CVE-2024-55565","summary":"Predictable results in nanoid generation when given non-integer values","details":"When nanoid is called with a fractional value, there were a number of undesirable effects:\n\n1. in browser and non-secure, the code infinite loops on while (size--)\n2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled\n3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error\n\nVersion 3.3.8 and 5.0.9 are fixed.","published":"2024-12-09T00:00:00Z","modified":"2026-08-12T03:51:16.682884476Z","cvss":{"score":4.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N"},"epss":{"score":0.00679,"percentile":0.49325,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"npm","name":"nanoid","fixedVersion":"5.0.9"},{"ecosystem":"npm","name":"nanoid","fixedVersion":"3.3.8"}],"fix":{"url":"https://github.com/ai/nanoid/pull/510","label":"ai/nanoid#510"},"references":[{"type":"WEB","url":"https://github.com/ai/nanoid/compare/3.3.7...3.3.8"},{"type":"WEB","url":"https://github.com/ai/nanoid/releases/tag/5.0.9"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/55xxx/CVE-2024-55565.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-55565"},{"type":"FIX","url":"https://github.com/ai/nanoid/pull/510"},{"type":"PACKAGE","url":"https://github.com/ai/nanoid"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:16.682884476Z"}}