VDB
Sign up
MEDIUM5.5

GHSA-qrpm-p2h7-hrv2

Exposure of Sensitive Information to an Unauthorized Actor in nanoid

Quick fix

GHSA-qrpm-p2h7-hrv2 — nanoid: upgrade to the fixed version with the command below.

npm install nanoid@3.1.31

Details

The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

Are you affected?

Enter the version of the package you're using.

Affected packages

npm/nanoid
Introduced in: 3.0.0Fixed in: 3.1.31
Fixnpm install nanoid@3.1.31

References