Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

crates.io package

nano-id

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Critical, CVSS 9.4crates.ioPublished

    Unable to generate the correct character set

    CVE-2024-36400 · GHSA-9hc7-6w9r-wj94

    Affected
    • crates.io nano-id < 0.4.0
    Fixed in
    0.4.0· Vendor fix available
    Issue
    Reduced entropy due to inadequate character set usage Description Affected versions of the nano-id crate incorrectly generated IDs using a reduced character set in the nanoid::base62 and nanoid::base58 functions. Specifically, the base62 function used a character set of 32 symbols instead of the intended 62 symbols, and the base58 function used a character set of 16 symbols instead of the intended 58 symbols. Additionally, the nanoid::gen macro is also affected when a custom character set that is not a power of 2 in size is specified. It should be noted that nanoid::base64 is not affected by this vulnerability. Impact This can result in a significant reduction in entropy, making the generated IDs predictable and vulnerable to brute-force attacks when the IDs are used in security-sensitive contexts such as session tokens or unique identifiers. Patches The flaws were corrected in commit a9022772b2f1ce38929b5b81eccc670ac9d3ab23 by updating the the nanoid::gen macro to use all specified…

    Recommended action: Upgrade to 0.4.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →