An integer overflow in the nanoid(size) function allows a crafted size value of 2147483648 to be interpreted as -2147483648, corrupting the library’s CSPRNG poolOffset. This overflow causes all subsequent tokens—including session identifiers, CSRF tokens, and API keys—to be the deterministic string “uuuuuuuuuuuuuuuuuuuuu”. An attacker who can supply the overflowed size can therefore predict future authentication tokens, enabling session hijacking, CSRF exploitation, and compromise of any system that relies on nanoid for unique identifiers.

All JavaScript projects that depend on the nanoid library with a version older than 3.3.12 or 5.1.11 are vulnerable. This includes many Node.js, Express, and front‑end applications that generate session or CSRF tokens, API keys, or unique identifiers via nanoid. The vulnerability affects both the ES module and CommonJS builds. Upgrading to 3.3.12 or later removes the signed‑integer coercion and restores proper random token generation.

The CVSS score of 7.4 indicates a high impact, but the EPSS score of less than 1 % suggests a low probability of exploitation at present, and the issue is not listed in the CISA KEV catalog. The likely attack vector is a form or API that permits the attacker to control or influence the size argument passed to nanoid, possibly through input validation bypass or direct payload injection. Once the overflow is triggered, the deterministic token pattern removes randomness, immediately exposing the application to session fixation, replay, or CSRF attacks.