The nanoid library before version 5.1.6 suffers from an infinite loop in the customAlphabet and customRandom functions when the size argument is set to zero. The internal generation loop never satisfies its exit condition, causing the calling thread to hang indefinitely. This flaw represents a denial‑of‑service condition and is classified as CWE‑835, an infinite loop leading to resource exhaustion.

The vulnerability affects the nanoid package from the nanoid project, a JavaScript/Node.js library used in server‑side code. Any installation of nanoid earlier than version 5.1.6 is vulnerable. The issue manifests when an application imports nanoid and calls customAlphabet or customRandom with a size value of zero.

The CVSS score of 8.2 indicates a high‑severity denial‑of‑service flaw. The EPSS probability is reported as < 1 %, suggesting that exploitation activity is currently limited, and the vulnerability is not listed in the CISA KEV catalog. Based on the description, the likely attack vector is an attacker‑controlled input that passes a size of 0 to nanoid’s custom functions, which may occur when the application forwards user‑supplied data to these functions without validation. A successful exploitation would cause the affected thread to hang, potentially disabling the service entirely.