Business information leak In nanoid
Description
Exposure of Sensitive Information to an Unauthorized Actor in nanoid The package nanoid from 3.0.0, before 3.1.31, are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 npm | 3.1.31 | ||
 debian 12 | 8.4.5+~cs7.1.51-1 | ||
debian 12 | 9.1.4+ds1+~cs28.2.8-1 | ||
debian 13 | 8.4.5+~cs7.1.51-1 | ||
debian 11 | 8.2.1+ds1+~cs29.4.27-3+deb11u1 | ||
debian 13 | 9.1.4+ds1+~cs28.2.8-1 | ||
debian 14 | 9.1.4+ds1+~cs28.2.8-1 | ||
debian 11 | 8.2.1+~cs5.3.23-8+deb11u1 | ||
debian 14 | 8.4.5+~cs7.1.51-1 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8.
References
1. 2. 3.