Log in Start free

Vulnerability · Published Jan 14, 2022 · Assigned by snyk

CVE-2021-23566Information Exposure

Medium 4.0

In plain English

A medium-severity security flaw in nanoid. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 38% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.0Medium
Exploit odds (30 days)0.4%top 61.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12node-mocha9.1.4+ds1+~cs28.2.8-1DEBIAN-CVE-2021-23566
Debian:13node-mocha9.1.4+ds1+~cs28.2.8-1DEBIAN-CVE-2021-23566
Debian:14node-mocha9.1.4+ds1+~cs28.2.8-1DEBIAN-CVE-2021-23566
Debian:12node-postcss8.4.5+~cs7.1.51-1DEBIAN-CVE-2021-23566
Debian:13node-postcss8.4.5+~cs7.1.51-1DEBIAN-CVE-2021-23566
Debian:14node-postcss8.4.5+~cs7.1.51-1DEBIAN-CVE-2021-23566
Ubuntu:22.04:LTSnode-mochano fix listedUBUNTU-CVE-2021-23566
Ubuntu:24.04:LTSnode-mochano fix listedUBUNTU-CVE-2021-23566
Ubuntu:25.10node-mochano fix listedUBUNTU-CVE-2021-23566
Ubuntu:26.04:LTSnode-mochano fix listedUBUNTU-CVE-2021-23566
Ubuntu:26.10node-mochano fix listedUBUNTU-CVE-2021-23566
Ubuntu:22.04:LTSnode-postcssno fix listedUBUNTU-CVE-2021-23566
Ubuntu:24.04:LTSnode-postcssno fix listedUBUNTU-CVE-2021-23566
Ubuntu:25.10node-postcssno fix listedUBUNTU-CVE-2021-23566
Ubuntu:26.04:LTSnode-postcssno fix listedUBUNTU-CVE-2021-23566
Ubuntu:26.10node-postcssno fix listedUBUNTU-CVE-2021-23566
npmnanoid3.1.31GHSA-qrpm-p2h7-hrv2

Affected products (as reported)

VendorProductVersions
n/a nanoid unspecified – before 3.1.31

References