https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 15:58:27 +0000 https://vulnerability.circl.lu/vuln/cve-2026-73086 <p><strong>Affected:</strong> ai nanoid</p> <p>nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string &#34;uuuuuuuuuuuuuuuuuuuuu&#34; until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.</p> <p><strong>Affected:</strong> ai nanoid</p> <p>nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string &#34;uuuuuuuuuuuuuuuuuuuuu&#34; until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.</p> https://vulnerability.circl.lu/vuln/cve-2026-73086