Listen to this Post
CVE-2026-73086 is an integer overflow vulnerability identified in the popular JavaScript library nanoid. This library is widely used for generating secure, URL-friendly, unique string IDs. The core of the issue lies in how the `nanoid(size)` function handles the user-supplied `size` parameter. When this function is called, it uses the `size |= 0` operation to coerce the input into a 32-bit signed integer. This operation, while intended for type conversion, creates a critical flaw: a user can provide a value equal to or greater than 2^31 (e.g., 2147483648). Due to the constraints of a signed 32-bit integer, this large number wraps around and becomes -2147483648.
This negative value is subsequently passed to the internal `fillPool()` function. The `fillPool()` function is responsible for managing a pool of cryptographically secure random bytes. The logic within `fillPool()` checks if the current pool exists and has enough space. However, because a negative number is always less than the pool’s length, both of its conditional branches fail to execute. Consequently, the pool is never refreshed, and crucially, the `poolOffset` variable is incremented by the negative value, setting it to approximately -2.1 billion.
With a deeply negative poolOffset, all subsequent calls to `nanoid()` enter a corrupted state. During ID generation, the code iterates using pool
</code>. Accessing an array with a negative index returns <code>undefined</code>. In JavaScript, the expression `undefined & 63` evaluates to 0. The `urlAlphabet[bash]` character is 'u', which means every single ID generated after the attack will be the identical, deterministic string "uuuuuuuuuuuuuuuuuuuuu". This corruption is process-wide and persists until the process is restarted or until approximately 100 million calls eventually cause the `poolOffset` to wrap back to a positive number.
The vulnerability is fixed in `nanoid` versions `3.3.12` and <code>5.1.11</code>. It is assigned a CVSS v3.1 base score of 7.4 (High), reflecting the significant impact on confidentiality and integrity.
<h2 style="color: blue;">DailyCVE Form</h2>
Platform: Node.js / JavaScript
Version: <3.3.12, >=4.0.0 <5.1.11
Vulnerability: Integer Overflow
Severity: High (7.4 CVSS)
Date: 2026-08-11
<h2 style="color: blue;">Prediction: Patch available (v3.3.12 / v5.1.11)</h2>
<h2 style="color: blue;">What Undercode Say:</h2>
The vulnerability stems from unsafe type coercion without proper bounds checking. Exploitation is straightforward, requiring only a single, unauthenticated request. The impact is severe as it compromises the randomness of all future IDs generated by the process.
<h2 style="color: blue;">Exploit: (Educational Purposes!)</h2>
[bash]
import { nanoid } from 'nanoid'
// Step 1: Normal operation
console.log(nanoid()) // e.g., "V1StGXR8_Z5jdHi6B-myT"
// Step 2: Trigger overflow
nanoid(2147483648)
// Step 3: All subsequent IDs are deterministic
console.log(nanoid()) // "uuuuuuuuuuuuuuuuuuuuu"
console.log(nanoid()) // "uuuuuuuuuuuuuuuuuuuuu"
Run with: `node --experimental-vm-modules poc.mjs`
Protection
- Upgrade to `nanoid` version `3.3.12` or `5.1.11` or later.
- Validate all user input: ensure the `size` parameter is a positive integer within a safe range before passing it to
nanoid(). - Use unsigned integers where possible to simplify validation.
Impact
- Complete Loss of Randomness: All session tokens, CSRF tokens, API keys, and unique identifiers generated after exploitation become identical and predictable.
- Process-Wide Corruption: The vulnerability affects the entire process, impacting all consumers of the `nanoid` library.
- Session Hijacking: An attacker can predict tokens issued to other users, allowing them to hijack sessions and bypass authentication.
- Low Barrier to Entry: The attack requires no special privileges and can be triggered by a single unauthenticated request.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
