Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
ai/nanoid
main @ ec6c2dc
7
Fixes
1
CVEs
HIGH
Peak severity
Highlights
Denial of Service: 5 prior fixes. Scrutinize any change in this area.
index.js: most-fixed (6 issues). Treat as high-risk during review.
5 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Fractional, negative, or zero-valued size arguments consistently bypass basic termination conditions in multiple core generator loops, triggering infinite loops and severe CPU exhaustion. Strict bitwise integer conversion and inequality checks are required.
Information Disclosure: A failure within the crypto subsystem during ID generation can leave uninitialized unsafe buffer segments in the reusable pool, leaking raw heap memory contents to subsequent requests if the pool state is not properly reset on exception.
Weak Cryptographic Selection: Passing extreme integer or overflow arguments corrupts the internal state of the random number pool, resulting in predictable or non-random ID generations that break cryptographic guarantees.