Update npm package nanoid to v5.1.16 [SECURITY]

[hash-dependencies]

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid	5.1.7 → 5.1.16

---

nanoid: non-secure generators can loop indefinitely with negative size

CVE-2026-67214 / GHSA-28wg-ghj8-5hjv

More information

Details

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-67214
• https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
• https://github.com/ai/nanoid/releases/tag/5.1.16
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
• https://github.com/ai/nanoid/pull/600
• https://github.com/ai/nanoid/pull/601
• https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d
• https://github.com/advisories/GHSA-28wg-ghj8-5hjv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

nanoid: custom generators can loop indefinitely when size is zero

CVE-2026-67213 / GHSA-2v37-7h3g-55p8

More information

Details

nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-67213
• https://github.com/ai/nanoid/commit/cb3626d0f3342fdf179cd425fd9c4fbb92c7d0e7
• https://github.com/ai/nanoid/releases/tag/5.1.6
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-zero-size-in-customalphabet-and-customrandom
• https://github.com/ai/nanoid/commit/f9d13f150847d117877adee3460a46eceb0cf49b
• https://github.com/ai/nanoid/releases/tag/3.3.17
• https://github.com/ai/nanoid/commit/e10f8d40ce9d1ab47f66d65a16b48086432730d0
• https://github.com/ai/nanoid/releases/tag/3.3.18
• https://github.com/advisories/GHSA-2v37-7h3g-55p8

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ai/nanoid (nanoid)

v5.1.16

Compare Source

• Fixed forever loop on negative size (by @​spokodev).

v5.1.15

Compare Source

• Fixed random pool corruption on big ID sizes.

v5.1.14

Compare Source

• Fixed npm package size regression.

v5.1.13

Compare Source

• Fixed npm package size regression.

v5.1.12

Compare Source

• Moved to npm Provenance and Staged Publishing.

v5.1.11

Compare Source

• Fixed breaking Nano ID by requesting big ID.

v5.1.10

Compare Source

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

v5.1.9

Compare Source

• Fixed npm package size regression.

v5.1.8

Compare Source

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[cursor]

PR Summary

Low Risk
Lockfile-only dependency patch with no app code changes; typical nanoid() usage is unaffected unless the app passes untrusted sizes to nanoid/non-secure.

Overview
Bumps the locked nanoid dependency from 5.1.7 to 5.1.16 in package-lock.json (no application source changes in this diff).

The upgrade addresses CVE-2026-67214, where nanoid/non-secure’s nanoid and customAlphabet could hang indefinitely if called with a negative size, enabling denial-of-service when that value is attacker-controlled. 5.1.16 fixes that loop; intermediate 5.1.x releases also include unrelated fixes (e.g. large ID / pool handling) bundled in the same version range.

^{Reviewed by Cursor Bugbot for commit 060f390. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Closing in favour of #430, which covers both nanoid copies.

This PR is a duplicate of #419 — the same lockfile-only edit of node_modules/nanoid, 5.1.7 → 5.1.16 — and both are being closed for the same reason: nanoid resolves at two paths here, and each has its own open HIGH advisory.

Path	Was	Advisory
node_modules/nanoid	5.1.7	GHSA-28wg-ghj8-5hjv (>=4.0.0 <5.1.16)
node_modules/postcss/node_modules/nanoid	3.3.17	GHSA-2v37-7h3g-55p8 (<3.3.18)

Only the first moves here, so GHSA-2v37-7h3g-55p8 stays open. The nested copy sits inside postcss's existing ^3.3.16 range, so it needs no override — but npm install --package-lock-only will not move it either, since npm keeps an already-satisfied resolution. It takes npm update nanoid, which is what #430 does, along with raising the declared range to ^5.1.16.

Confirmed against the npm bulk audit endpoint: this branch's lockfile still returns GHSA-2v37-7h3g-55p8 for its resolved 3.3.17, while #430's returns {} for {"nanoid":["5.1.16","3.3.18"]}.

[hash-dependencies]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (^5.1.7). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.