CVE-2024-55565: Medium severity IBM Business Automation Insights vulnerability
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
Other sources
When nanoid is called with a fractional value, there were a number of undesirable effects:
1. in browser and non-secure, the code infinite loops on while (size--) 2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled 3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error
Version 3.3.8 and 5.0.9 are fixed.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-55565?
CVE-2024-55565 is classified as a moderate vulnerability due to its potential impact on application behavior when mishandling non-integer values.
How do I fix CVE-2024-55565?
To fix CVE-2024-55565, upgrade nanoid to version 5.0.9 or later or to version 3.3.8, which addresses the vulnerability.
What software is affected by CVE-2024-55565?
CVE-2024-55565 affects all versions of nanoid prior to 5.0.9 and specifically versions before 3.3.8.
What are the undesirable effects of CVE-2024-55565?
CVE-2024-55565 can lead to unpredictable behavior when fractional values are used with the nanoid library.
Is there an easy way to identify if I'm using a vulnerable version of nanoid for CVE-2024-55565?
If you're using nanoid version prior to 5.0.9 or 3.3.8, you are likely using a vulnerable version susceptible to CVE-2024-55565.