CVE-2024-55565
CVE-2024-55565
This page contains facts from public vulnerability sources. Check the original advisory before updating.
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
CVSS 4.3 · Medium · EPSS 0.7% · Fix available
- Published
- Updated
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
node-mocha Debian:12
- Affected ranges
- ECOSYSTEM: < 9.1.4+ds1+~cs28.2.8-1
Update to 9.1.4+ds1+~cs28.2.8-1
node-mocha Debian:13
- Affected ranges
- ECOSYSTEM: < 9.1.4+ds1+~cs28.2.8-1
Update to 9.1.4+ds1+~cs28.2.8-1
node-mocha Debian:14
- Affected ranges
- ECOSYSTEM: < 9.1.4+ds1+~cs28.2.8-1
Update to 9.1.4+ds1+~cs28.2.8-1
node-postcss Debian:12
- Versions
- 8.4.20+~cs8.0.23-1
- Affected ranges
- ECOSYSTEM: < 8.4.20+~cs8.0.23-1+deb12u1
Update to 8.4.20+~cs8.0.23-1+deb12u1
node-postcss Debian:13
- Affected ranges
- ECOSYSTEM: < 8.4.49+~cs9.2.32-1
Update to 8.4.49+~cs9.2.32-1
node-postcss Debian:14
- Affected ranges
- ECOSYSTEM: < 8.4.49+~cs9.2.32-1
Update to 8.4.49+~cs9.2.32-1
nanoid npm
- Affected ranges
- SEMVER: ≥ 4.0.0, < 5.0.9
Update to 5.0.9
nanoid npm
- Affected ranges
- SEMVER: < 3.3.8
Update to 3.3.8
node-postcss Ubuntu:20.04:LTS
- Versions
- 6.0.23-1
- 6.0.23-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-postcss Ubuntu:22.04:LTS
- Versions
- 8.2.1+~cs5.3.23-8
- 8.4.5+~cs7.1.51-2
- 8.4.6+~cs7.3.21-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
node-postcss Ubuntu:24.04:LTS
- Versions
- 8.4.20+~cs8.0.23-1
- 8.4.31+~cs8.0.26-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://github.com/ai/nanoid/pull/510
- https://github.com/ai/nanoid/releases/tag/5.0.9
- https://github.com/ai/nanoid/compare/3.3.7...3.3.8
- https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html
- https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
- https://nvd.nist.gov/vuln/detail/CVE-2024-55565