Security advisory details for CVE-2024-55565?

[krassowski]

Hi folks, downstreams started getting notifications about a security issue in nanoid, but it looks like the advisory is pretty bare-bones. Can you please indicate the severity of GHSA-mwcw-c2x4-8c55 ? Thanks!

[Redirts]

I am also curious why the vulnerability was fixed in 3.3.8 but v4 did not get the fix (i.e. version 4.0.3)

[ai]

@Redirts we do not support 4.x. It is pretty easy to migrate from 4.x to 5.x.

Of course, 4.x could be fixed as part of commercial support if some company wants to save money.

[ai]

@krassowski give them a time. I wrote to CVE publisher about it.

Severity is low. Your app should allow user input as ID size and has not type check for it. I assume that only 1-5 systems will be affected in the world.

[myndzi]

I believe @ai meant "should not allow user input", not "should" :)

I don't know who renamed the github advisory to "infinite loop", but that makes the sparse information worse :(

The security case goes something like:

• Malicious user influences the length argument to nanoid() to be a fractional value (either directly or indirectly, e.g. through prototype pollution)
• The next so many ids generated will all be the same (some variant of uuuu which is just all zeroes)
• This can cause collisions or predictable ids, when ids are expected to be unpredictable and not collide
• The impact kinda depends on what the ids are used for

Depending on which "variant" of the nanoid code is being used, some of them will infinite loop instead, which obviously can be a DOS

If the code is just calling nanoid() or calling it with some constant length value (not influencable), then there's no risk afaik.

[ai]

I believe @ai meant "should not allow user input", not "should" :)

Yes. To have an issue you app should allow user input

If the code is just calling nanoid() or calling it with some constant length value (not influencable), then there's no risk afaik.

Yes

I don't know who renamed the github advisory to "infinite loop", but that makes the sparse information worse :(

I asked to change it