The Nano ID library contains an infinite loop in its non‑secure customAlphabet and nanoid functions when a negative size is supplied. The loop counter starts negative and never satisfies the termination condition, causing the calling thread to spin endlessly and hang the application. This results in a denial‑of‑service condition for any process that imports the vulnerable module and passes an unvalidated, attacker‑controlled negative size.

The vulnerability affects the nanoid library being used in Node.js applications; no explicit affected version list is provided by the CNA. Any program that imports nanoid/non-secure and passes a negative size argument—directly or indirectly via user input—can trigger the loop. The issue is confined to the non‑secure module of the library.

The CVSS score of 8.2 indicates a high impact vulnerability, while the EPSS score of less than 1% suggests a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector is inferred to be remote if the application accepts network input, or local if local input is used, because the flaw depends on an attacker-controlled negative size being passed to the library functions. This inference is not stated explicitly in the advisory but is derived from the description of the function usage. Once triggered, the affected thread will hang, potentially exhausting resources and causing service downtime.