CVE-2021-23566

The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated.

CVSS v3 4.0 MEDIUM
CVSS v2.0 2.1 LOW

4.0^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.5 / Impact : 1.4

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.1^/10

CVSS v2.0 : LOW

Vector : AV:L/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 3.9 / Impact : 2.9

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444	Exploit Third Party Advisory
https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575	Patch Third Party Advisory
https://github.com/ai/nanoid/pull/328	Exploit Issue Tracking Patch Third Party Advisory
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550	Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JS-NANOID-2332193	Exploit Third Party Advisory
https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444	Exploit Third Party Advisory
https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575	Patch Third Party Advisory
https://github.com/ai/nanoid/pull/328	Exploit Issue Tracking Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html
https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html
https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550	Exploit Third Party Advisory
https://snyk.io/vuln/SNYK-JS-NANOID-2332193	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:nanoid_project:nanoid:*:*:*:*:*:node.js:*:*

History

03 Nov 2025, 22:15

Type	Values Removed	Values Added
References		() https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html - () https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html -

Information

Published : 2022-01-14 20:15

Updated : 2025-11-03 22:15

NVD link : CVE-2021-23566

Mitre link : CVE-2021-23566

CVE.ORG link : CVE-2021-23566

JSON object : View

Products Affected

nanoid_project

nanoid

CWE

CWE-704

Incorrect Type Conversion or Cast

{"id": "CVE-2021-23566", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.1, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "report@snyk.io", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.0, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.5}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2022-01-14T20:15:10.093", "references": [{"url": "https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575", "tags": ["Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://github.com/ai/nanoid/pull/328", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://snyk.io/vuln/SNYK-JS-NANOID-2332193", "tags": ["Exploit", "Third Party Advisory"], "source": "report@snyk.io"}, {"url": "https://gist.github.com/artalar/bc6d1eb9a3477d15d2772e876169a444", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ai/nanoid/commit/2b7bd9332bc49b6330c7ddb08e5c661833db2575", "tags": ["Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://github.com/ai/nanoid/pull/328", "tags": ["Exploit", "Issue Tracking", "Patch", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2024/12/msg00025.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00006.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-2332550", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://snyk.io/vuln/SNYK-JS-NANOID-2332193", "tags": ["Exploit", "Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-704"}]}], "descriptions": [{"lang": "en", "value": "The package nanoid from 3.0.0 and before 3.1.31 are vulnerable to Information Exposure via the valueOf() function which allows to reproduce the last id generated."}, {"lang": "es", "value": "El paquete nanoid desde la versi\u00f3n 3.0.0 y antes de la versi\u00f3n 3.1.31, es vulnerable a una Exposici\u00f3n de Informaci\u00f3n por medio de la funci\u00f3n valueOf() que permite reproducir el \u00faltimo id generado"}], "lastModified": "2025-11-03T22:15:47.710", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:nanoid_project:nanoid:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "6264B90E-B9A3-4BA7-9CF8-88C3994317BA", "versionEndExcluding": "3.1.31", "versionStartIncluding": "3.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "report@snyk.io"}