The nanoid library contains an infinite loop in its non-secure customAlphabet and nanoid functions when a negative size is supplied. The loop counter starts with a negative value and is decremented, never meeting the termination condition, which causes the calling thread to spin indefinitely and eventually hang the application. This results in a denial‑of‑service condition for any process that imports the vulnerable module and passes an unvalidated, attacker‑controlled negative size argument.

The vulnerability applies to Node.js applications that import the nanoid library, specifically the nanoid/non-secure module. Versions of nanoid prior to 3.3.16 and 5.1.16 are affected; these releases contain the infinite loop flaw. All code that invokes customAlphabet or nanoid with a size value that could be negative is at risk.

The CVSS score of 8.2 classifies this issue as high impact, while the EPSS score of less than 1% indicates a low probability of exploitation. The flaw is not listed in CISA’s KEV catalog. The likely attack vector is inferred to be remote if the application accepts network input that can influence the size parameter, or local if the size comes from a local source. A successful exploitation would cause a thread to hang and could exhaust resources, leading to service degradation or outage.