CVE-2026-73086

Status: DeferredHigh (7.4)—

nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.

CVSS

Version: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Base score: 7.4

Exploitation probability (EPSS)

Probability of exploitation in the next 30 days: 0.30%
Percentile among all scored CVEs: 20
Score date: 10/5/2026

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

🎯 ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access75 %
Primary impactT1552 Unsecured Credentialscredential access80 %
Secondary impactT1078 Valid Accountsstealth · persistence · privilege escalation · initial access75 %

AV:N sin autenticación permite explotación remota de aplicación (T1190). La corrupción del CSPRNG expone tokens de sesión, CSRF y claves API (T1552). Atacantes pueden secuestrar sesiones/credenciales (T1078). CWE-190 (desbordamiento) en parámetro público.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

🛡️ ATT&CK mitigations that cover these techniques

Privileged Account Management Active Directory Configuration User Training Password Policies Limit Access to Resource Over Network Filter Network Traffic

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Nanoid — Nanoid^AI

CWEs

CWE-190

References

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-73086",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-73086",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-08-12T14:26:22.656696Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.4,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.2,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "ai",
          "product": "nanoid",
          "versions": [
            {
              "status": "affected",
              "version": "< 3.3.12"
            },
            {
              "status": "affected",
              "version": ">= 4.0.0, < 5.1.11"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-08-11T17:19:16.690",
  "references": [
    {
      "url": "https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202ac",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ai/nanoid/releases/tag/3.3.12",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ai/nanoid/releases/tag/5.1.11",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9w",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string \"uuuuuuuuuuuuuuuuuuuuu\" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11."
    }
  ],
  "lastModified": "2026-09-09T20:46:02.457",
  "sourceIdentifier": "security-advisories@github.com"
}