4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-55565

CVE-2024-55565: Predictable results in nanoid generation when given non-integer values

When nanoid is called with a fractional value, there were a number of undesirable effects:

in browser and non-secure, the code infinite loops on while (size--)
in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled
if the first call in node is a fractional argument, the initial buffer allocation fails with an error

Version 3.3.8 and 5.0.9 are fixed.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-55565

CVE-2024-55565:

4.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
nanoid	npm	>= 4.0.0, < 5.0.9	5.0.9
nanoid	npm	< 3.3.8	3.3.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerable functions were identified by analyzing the changes in commit 'ae1075df9e7c1917ad164ea7954ab15920c0beff', which addresses the vulnerability. The core issue is the handling of fractional numeric inputs for 'size' or 'bytes' parameters in various functions across different nanoid implementations (browser, Node.js, async, non-secure).

The patches primarily involve:

Casting the input 'size' or derived values ('step', 'i', 'j') to integers using a bitwise OR with zero (e.g., size |= 0, step | 0). This prevents fractional values from causing issues in loops like while (size--) or array indexing/allocations.
Modifying loop exit conditions (e.g., id.length === size to id.length >= size) to correctly handle cases where 'size' might be fractional and an exact match is impossible for an integer length.

The identified functions are those where these changes were made, indicating they were previously susceptible to the described problems: infinite loops (in browser/non-secure contexts due to while (fractional_value--)), predictable output/zeroes (in Node.js due to fractional poolOffset after fillPool is called with a fractional size), or buffer allocation errors (in Node.js if fillPool receives a problematic fractional size). Functions like customAlphabet are included if they either directly contained such a loop or condition, or if they served as an entry point that passed a fractional value to another vulnerable internal function (like random in index.js) that was subsequently patched.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.