p PatchFirst

CVE-2021-23566

CVE-2021-23566 · Information Exposure

This page contains facts from public vulnerability sources. Check the original advisory before updating.

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

CVSS 4.0 · Medium · EPSS 0.4% · Fix available

Published
Updated

Stack: system · node

Affected products and versions

  • nanoid

    Versions
    • ≥ unspecified, < 3.1.31: Affected (custom)

    Update to 3.1.31

  • node-mocha Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.1.4+ds1+~cs28.2.8-1

    Update to 9.1.4+ds1+~cs28.2.8-1

  • node-mocha Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.1.4+ds1+~cs28.2.8-1

    Update to 9.1.4+ds1+~cs28.2.8-1

  • node-mocha Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.1.4+ds1+~cs28.2.8-1

    Update to 9.1.4+ds1+~cs28.2.8-1

  • node-postcss Debian:12

    Affected ranges
    • ECOSYSTEM: < 8.4.5+~cs7.1.51-1

    Update to 8.4.5+~cs7.1.51-1

  • node-postcss Debian:13

    Affected ranges
    • ECOSYSTEM: < 8.4.5+~cs7.1.51-1

    Update to 8.4.5+~cs7.1.51-1

  • node-postcss Debian:14

    Affected ranges
    • ECOSYSTEM: < 8.4.5+~cs7.1.51-1

    Update to 8.4.5+~cs7.1.51-1

  • nanoid npm

    Affected ranges
    • SEMVER: ≥ 3.0.0, < 3.1.31

    Update to 3.1.31

  • node-mocha Ubuntu:16.04:LTS

    Versions
    • 1.20.1-1
    • 1.20.1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mocha Ubuntu:18.04:LTS

    Versions
    • 1.20.1-7
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mocha Ubuntu:20.04:LTS

    Versions
    • 4.1.0+ds3-5
    • 7.0.1+ds1-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-postcss Ubuntu:20.04:LTS

    Versions
    • 6.0.23-1
    • 6.0.23-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mocha Ubuntu:22.04:LTS

    Versions
    • 8.2.1+ds1+~cs29.4.27-3
    • 9.1.3+ds1+~cs31.2.38-1
    • 9.2.0+ds1+~cs28.3.8-1
    • 9.2.1+ds1+~cs28.3.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-postcss Ubuntu:22.04:LTS

    Versions
    • 8.2.1+~cs5.3.23-8
    • 8.4.5+~cs7.1.51-2
    • 8.4.6+~cs7.3.21-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mocha Ubuntu:24.04:LTS

    Versions
    • 10.2.0+ds1+~cs29.5.1-1
    • 10.4.0+ds1+~cs33.1.8-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-postcss Ubuntu:24.04:LTS

    Versions
    • 8.4.20+~cs8.0.23-1
    • 8.4.31+~cs8.0.26-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mocha Ubuntu:25.10

    Versions
    • 10.7.2+ds1+~cs33.1.11-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-postcss Ubuntu:25.10

    Versions
    • 8.4.49+~cs9.2.32-1
    • 8.5.6+~cs9.3.28-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mocha Ubuntu:26.10

    Versions
    • 11.7.5+ds1+~cs36.3.14-2
    • 11.7.7+ds1+~cs36.3.16-1
    • 11.8.0+ds1+~cs36.4.12-1
    • 11.8.0+ds1+~cs36.4.12-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-postcss Ubuntu:26.10

    Versions
    • 8.5.8+~cs9.3.30-1
    • 8.5.15+~cs9.3.34-1
    • 8.5.15+~cs9.3.38-1
    • 8.5.15+~cs9.3.39-1build1
    • 8.5.25+~cs10.2.23-1
    • 8.5.26+~cs10.2.24-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-mocha Ubuntu:26.04:LTS

    Versions
    • 10.7.2+ds1+~cs33.1.11-2
    • 11.7.2+ds1+~cs36.3.14-2build1
    • 11.7.5+ds1+~cs36.3.14-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • node-postcss Ubuntu:26.04:LTS

    Versions
    • 8.5.6+~cs9.3.28-1
    • 8.5.8+~cs9.3.30-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →