CVE-2021-23566

Information Exposure

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Affected

nanoid

CVSS v3.1 NVD

5.5 MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

CVSS v3.1 SNYK

4.0 MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

CVSS v2.0 NVD

2.1 LOWAV:L/AC:L/Au:N/C:P/I:N/A:N

EPSS

0.44% chance of exploitation in the next 30 days, 37th percentile

Published

2022-01-14

Updated

2025-11-03

Proof-of-concept exploits (2)

• https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550
• https://snyk.io/vuln/SNYK-JS-NANOID-2332193

Security advisories

• https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444
• ai/nanoid/pull/328
• advisories/GHSA-qrpm-p2h7-hrv2

References

• CVE Record
• NVD entry