CVE-2021-23566

MEDIUM5.5EPSS 0.03%

Exposure of Sensitive Information to an Unauthorized Actor in nanoid

Published: 1/21/2022Modified: 11/4/2025

Also known as:GHSA-qrpm-p2h7-hrv2DEBIAN-CVE-2021-23566

Description

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Affected packages (5)

Debian/node-mochafrom 0, < 8.2.1+ds1+~cs29.4.27-3+deb11u1
Debian/node-mochafrom 0, < 8.2.1+ds1+~cs29.4.27-3+deb11u1
Debian/node-postcssfrom 0, < 8.2.1+~cs5.3.23-8+deb11u1
Debian/node-postcssfrom 0, < 8.2.1+~cs5.3.23-8+deb11u1
npm/nanoid>= 3.0.0, < 3.1.31

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.5	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

References (10)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-23566
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2021-23566
PATCHhttps://github.com/ai/nanoid
WEBhttps://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444
WEBhttps://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575
WEBhttps://github.com/ai/nanoid/pull/328
WEBhttps://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
WEBhttps://lists.debian.org/debian-lts-announce/2025/01/msg00006.html
WEBhttps://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550
WEBhttps://snyk.io/vuln/SNYK-JS-NANOID-2332193