High [CVE-2026-67214] Denial of Service via negative size input in non-secure module functions

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread.

An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition. A flaw was found in nanoid (Nano ID), a JavaScript library used for generating unique identifiers.

This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a negative size input to the customAlphabet or nanoid functions within the library's non-secure module. When a negative size is provided, these functions enter an infinite loop, causing the application to hang indefinitely and disrupting service availability.

Red Hat severity: Important — CVSS 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-839.

Affected products named by the advisory: multicluster engine for Kubernetes 2.17; multicluster engine for Kubernetes 2.8; multicluster engine for Kubernetes 2.9; Red Hat Advanced Cluster Management for Kubernetes 2.11; and 35 more.