GitHub Advisoryadvisory · npm

GHSA-qrpm-p2h7-hrv2 Exposure of Sensitive Information to an Unauthorized Actor in nanoid

MEDIUM Published 2022-01-21 Modified 2025-11-04 Official page ↗
Aliases
CVE-2021-23566
Ecosystem
npm
Packages
nanoid
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-200, CWE-704
Reviewed
2022-01-18

Affected packages

• npm nanoid: >= 3.0.0, < 3.1.31 → fixed in 3.1.31

Description

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Related

Alias · CVE (1)

  • CVE-2021-23566 The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce… vulnerability

Weakness · CWE (2)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness
  • CWE-704 Incorrect Type Conversion or Cast weakness

References