nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
CVE-2026-73086
HIGHPre-NVD 7.47.4—Trending — Patch released this week
EchelonGraph scoreMEDIUM confidence
This high-severity CVE scores 7.4 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.3%, top 78% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).
Triggered by: NVD CVSS baseline
Sources: epss, secondary
7.4EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
- High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.4Exploit: None knownExposed: 0
A fix is available — apply it.
- CVSS v3
- 7.4
- EG Score
- 7.4(medium)
- EG Risk
- 33(Track)EG Risk 33/100SSVC: Track
EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).
How it’s computedSeverity74% × 45%Exploitation0% × 40%Automatability0% × 15%Action: Routine — remediate on your standard cadence. - EPSS PROB
- 0%
- EPSS %ILE
- 22%
- KEV
- Not listed
Published
August 11, 2026
Last Modified
August 12, 2026
Advisory Details (6)
Auto-updated Aug 12, 2026🔬 Proof of concept available. Patch available. Sources: github_commit, github_release, github.
github Patch Available🟡 PoC Available
Integer Overflow or Wraparound in nanoid · Advisory · ai/nanoid · GitHub
https://github.com/ai/nanoid/security/advisories/GHSA-xwg4-73v4-xw9wgithub_release Patch Available
5.1.11
Patch available: ai/nanoid 5.1.11
https://github.com/ai/nanoid/releases/tag/5.1.11github_release Patch Available
3.3.12
Patch available: ai/nanoid 3.3.12
https://github.com/ai/nanoid/releases/tag/3.3.12github_commit Patch Available
commit b0036ed60dc9 (ai/nanoid)
Patch available: ai/nanoid 3.3.13 (contains commit b0036ed60dc9)
https://github.com/ai/nanoid/commit/b0036ed60dc9facd7f1191a50dfb3076500202acgithub_commit Patch Available
commit 821dfed7b5db (ai/nanoid)
Patch available: ai/nanoid 3.3.12 (contains commit 821dfed7b5db)
https://github.com/ai/nanoid/commit/821dfed7b5db7f88e92f56c60eef32c8135077c3github_commit Patch Available
commit 7087969281ca (ai/nanoid)
Patch available: ai/nanoid 5.1.11 (contains commit 7087969281ca)
https://github.com/ai/nanoid/commit/7087969281cab8ba8ae3babf1894e819068b3bb4Vendor Advisories for CVE-2026-73086(6)
These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.
- RHSA-2026:54760Red Hat Product SecurityHigh
Red Hat Security Advisory: A Subscription Management tool for finding and reporting Red Hat product usage
- RHSA-2026:54520Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- RHSA-2026:54518Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- RHSA-2026:54412Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
- RHSA-2026:50287Red Hat Product SecurityHigh
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
- RHSA-2026:48758Red Hat Product SecurityCritical
Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update
Patch Availability(6)
| Vendor / Ecosystem | Fixed in / Patch | Released | Source |
|---|---|---|---|
| redhat | grafana12-4-main-12.4.8-0.1.1.hum1 | 2026-08-13 | redhat |
| redhat | prometheus3-5-main-3.5.5-0.8.hum1 | 2026-08-13 | redhat |
| redhat | discovery/discovery-ui-rhel9:1786634825 | 2026-08-13 | redhat |
| redhat | grafana13-1-main-13.1.3-0.1.hum1 | 2026-08-12 | redhat |
| redhat | prometheus3-13-main-3.13.2-0.2.hum1 | 2026-08-04 | redhat |
| redhat | jaeger-main-2.20.0-0.8.hum1 | 2026-07-30 | redhat |
Patches are aggregated from vendor advisories (Red Hat, Microsoft, Cisco, GitHub) and package ecosystems (OSV, GHSA). Multiple rows for the same upstream release have been deduplicated.
Weakness Classification(1)
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Data Freshness Timeline
(refreshed 14× in last 7d / 14× in last 30d)
Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.
- 2026-08-15 04:30 UTCEG score recompute
- 2026-08-15 04:30 UTCVendor advisory
- 2026-08-15 01:31 UTCEPSS rescore
- 2026-08-14 16:17 UTCVendor advisory
- 2026-08-14 04:05 UTCEG score recompute
- 2026-08-14 04:05 UTCVendor advisory
- 2026-08-13 22:00 UTCEPSS rescore
- 2026-08-13 15:52 UTCVendor advisory
- 2026-08-12 15:27 UTCEG score recompute
- 2026-08-12 14:49 UTCEG score recompute
- 2026-08-12 13:51 UTCEPSS rescore
- 2026-08-11 17:43 UTCEG score recompute
- 2026-08-11 17:18 UTCEG score recompute
- 2026-08-11 17:11 UTCMITRE cvelistV5first tracked
Related CVEs(same vendor + same CWE)
Same vendor
10 shownredhat
- CVE-2001-0825EG 10.0HIGH
- CVE-2001-1009EG 10.0EPSS p93HIGH
- CVE-2001-0554EG 10.0EPSS p98HIGH
- CVE-2001-1162EG 10.0EPSS p96HIGH
- CVE-2001-0414EG 10.0EPSS p100HIGH
- CVE-2001-0191EG 10.0EPSS p92HIGH
- CVE-2001-0301EG 10.0EPSS p90HIGH
- CVE-2001-0197EG 10.0EPSS p96HIGH
- CVE-2001-0233EG 10.0EPSS p96HIGH
- CVE-2001-0010EG 10.0EPSS p98HIGH
Same CWE
10 shownCWE-190
Frequently asked(5)
What is CVE-2026-73086?
CVE-2026-73086 is a high vulnerability published on August 11, 2026. nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and…
When was CVE-2026-73086 disclosed?
CVE-2026-73086 was first published in the National Vulnerability Database on August 11, 2026, with the most recent update on August 12, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-73086 actively exploited?
CVE-2026-73086 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 77.9% of all scored CVEs.
What is the CVSS score of CVE-2026-73086?
CVE-2026-73086 has a CVSS v3 base score of 7.4 (NVD).
How do I remediate CVE-2026-73086?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-73086, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.
Dependency Blast Radius
Explore the affected products and dependency analysis for CVE-2026-73086
Is Your Infrastructure Affected by CVE-2026-73086?
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.