nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
Advisories
Source ID Title
Debian DLA Debian DLA DLA-4003-1 node-postcss security update
Debian DLA Debian DLA DLA-4013-1 node-mocha security update
EUVD EUVD EUVD-2024-3491 nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
Github GHSA Github GHSA GHSA-mwcw-c2x4-8c55 Predictable results in nanoid generation when given non-integer values
Fixes

Solution

No solution given by the vendor.


Workaround

No workaround given by the vendor.

History

Tue, 04 Nov 2025 08:30:00 +0900


Tue, 15 Jul 2025 22:45:00 +0900

Type Values Removed Values Added
Metrics epss

{'score': 0.00013}

epss

{'score': 0.00015}


Sat, 29 Mar 2025 00:00:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_ai:2.16::el8
cpe:/a:redhat:rhdh:1.5::el9

Fri, 21 Mar 2025 15:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:rhdh:1.3::el9

Wed, 12 Mar 2025 15:30:00 +0900

Type Values Removed Values Added
CPEs cpe:/a:redhat:openshift_data_foundation:4.18::el9

Fri, 14 Feb 2025 11:30:00 +0900

Type Values Removed Values Added
First Time appeared Redhat openshift Ai
Redhat rhdh
CPEs cpe:/a:redhat:openshift_ai:2.17::el8
cpe:/a:redhat:rhdh:1.4::el9
Vendors & Products Redhat openshift Ai
Redhat rhdh

Thu, 13 Feb 2025 09:45:00 +0900

Type Values Removed Values Added
First Time appeared Redhat
Redhat acm
Redhat ansible Automation Platform
Redhat discovery
Redhat logging
Redhat multicluster Engine
Redhat openshift
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat service Mesh
CPEs cpe:/a:redhat:acm:2.11::el9
cpe:/a:redhat:acm:2.12::el9
cpe:/a:redhat:ansible_automation_platform:2.5::el8
cpe:/a:redhat:ansible_automation_platform:2.5::el9
cpe:/a:redhat:logging:5.9::el9
cpe:/a:redhat:multicluster_engine:2.6::el8
cpe:/a:redhat:multicluster_engine:2.6::el9
cpe:/a:redhat:multicluster_engine:2.7::el8
cpe:/a:redhat:multicluster_engine:2.7::el9
cpe:/a:redhat:openshift:4.17::el9
cpe:/a:redhat:openshift_data_foundation:4.16::el9
cpe:/a:redhat:openshift_data_foundation:4.17::el9
cpe:/a:redhat:openshift_devspaces:3::el9
cpe:/a:redhat:service_mesh:2.5::el8
cpe:/o:redhat:discovery:1.0::el9
Vendors & Products Redhat
Redhat acm
Redhat ansible Automation Platform
Redhat discovery
Redhat logging
Redhat multicluster Engine
Redhat openshift
Redhat openshift Data Foundation
Redhat openshift Devspaces
Redhat service Mesh

Fri, 13 Dec 2024 04:15:00 +0900

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'}


Mon, 09 Dec 2024 23:15:00 +0900

Type Values Removed Values Added
Title nanoid: nanoid mishandles non-integer values
Weaknesses CWE-835
References
Metrics threat_severity

None

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate


Mon, 09 Dec 2024 10:30:00 +0900

Type Values Removed Values Added
Description nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2025-11-03T22:32:41.164Z

Reserved: 2024-12-09T00:00:00.000Z

Link: CVE-2024-55565

cve-icon Vulnrichment

Updated: 2024-12-12T18:50:48.702Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2024-12-09T02:15:19.607

Modified: 2025-11-03T23:17:30.213

Link: CVE-2024-55565

cve-icon Redhat

Severity : Moderate

Publid Date: 2024-12-09T00:00:00Z

Links: CVE-2024-55565 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses