Update npm package nanoid to v5 [SECURITY]

[hash-dependencies]

This PR contains the following updates:

Package	Change	Age	Confidence
nanoid	3.3.11 → 5.1.16

---

nanoid: non-secure generators can loop indefinitely with negative size

CVE-2026-67214 / GHSA-28wg-ghj8-5hjv

More information

Details

nanoid (Nano ID) before 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented from a negative value and never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that passes an unvalidated, attacker-controlled negative size to these functions is exposed to a denial-of-service condition.

Severity

• CVSS Score: 8.2 / 10 (High)
• Vector String: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

• https://nvd.nist.gov/vuln/detail/CVE-2026-67214
• https://github.com/ai/nanoid/commit/6ccc67bbaba71d3d77a21d9b636f4171a268ce49
• https://github.com/ai/nanoid/releases/tag/5.1.16
• https://www.vulncheck.com/advisories/nanoid-before-infinite-loop-via-negative-size-in-non-secure-module
• https://github.com/ai/nanoid/pull/600
• https://github.com/ai/nanoid/pull/601
• https://github.com/ai/nanoid/commit/e835c9b71eab832bc6106944bdd26ea96cf2c66d
• https://github.com/advisories/GHSA-28wg-ghj8-5hjv

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

---

Release Notes

ai/nanoid (nanoid)

v5.1.16

Compare Source

• Fixed forever loop on negative size (by @​spokodev).

v5.1.15

Compare Source

• Fixed random pool corruption on big ID sizes.

v5.1.14

Compare Source

• Fixed npm package size regression.

v5.1.13

Compare Source

• Fixed npm package size regression.

v5.1.12

Compare Source

• Moved to npm Provenance and Staged Publishing.

v5.1.11

Compare Source

• Fixed breaking Nano ID by requesting big ID.

v5.1.10

Compare Source

• Fixed breaking Nano ID by requesting big ID (by @​alanzabihi).

v5.1.9

Compare Source

• Fixed npm package size regression.

v5.1.8

Compare Source

• Made cusatomAlphabet 75% faster (by @​saripovdenis).

v5.1.7

Compare Source

• Added --version to CLI (by @​mahmoodhamdi).
• Updated nanoid.js for CDN (by @​mahmoodhamdi).
• Fixed docs (by @​mahmoodhamdi).
• Fixed customRandom types (by @​oguimbal).

v5.1.6

Compare Source

• Fixed infinite loop on 0 size for customAlphabet.

v5.1.5

Compare Source

• Fixed latest version on npm after 3.x release.

v5.1.4

Compare Source

• Fixed latest version on npm after 3.x release.

v5.1.3

Compare Source

• Fixed React Native support (by @​steida).

v5.1.2

Compare Source

• Fixed module docs.

v5.1.1

Compare Source

• Fixed forever loop on negative size (by @​spokodev).

v5.1.0

Compare Source

• Added opaque types support (by @​kossnocorp).

v5.0.9

Compare Source

• Fixed a way to break Nano ID by passing non-integer size (by @​myndzi).

v5.0.8

Compare Source

• Reduced customAlphabet size (by @​kirillgroshkov).

v5.0.7

Compare Source

• Fixed Parcel support (by @​WilhelmYakunin).

v5.0.6

Compare Source

• Fixed React Native support.

v5.0.5

Compare Source

• Make browser’s version faster by increasing size a little (by Samuel Elgozi).

v5.0.4

Compare Source

• Fixed CLI docs (by @​ilyaboka).

v5.0.3

Compare Source

• Fixed CLI docs (by Chris Schmich).

v5.0.2

Compare Source

• Fixed webcrypto import (by Divyansh Singh).

v5.0.1

Compare Source

• Fixed Node.js 18 support.

v5.0.0

Compare Source

v4.0.2

Compare Source

• Added link to Github Sponsors.

v4.0.1

Compare Source

• Reduced npm package size (by @​HiChen404).

v4.0.0

Compare Source

v3.3.18

Compare Source

• Fixed infinite loop on async for React Native (by @​OvergrowthBeards-JB).

v3.3.17

Compare Source

• Fixed infinite loop on zero size.

v3.3.16

Compare Source

• Fixed infinite loop on negative size (by @​greymoth-jp).

v3.3.15

Compare Source

• Fixed npm provenance error.

v3.3.14

Compare Source

• Fixed random pool corruption on big ID sizes.

v3.3.13

Compare Source

• Reduced npm package size.

v3.3.12

Compare Source

• Fixed breaking Nano ID by requesting big ID.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • "before 4am every weekday,every weekend"

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[hash-dependencies]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: yarn.lock

error This project's package.json defines "packageManager": "yarn@4.16.0". However the current global version of Yarn is 1.22.22.

Presence of the "packageManager" field indicates that the project is meant to be used with Corepack, a tool included by default with all official Node.js distributions starting from 16.9 and 14.19.
Corepack must currently be enabled by running corepack enable in your terminal. For more information, check out https://yarnpkg.com/corepack.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Error		Aug 9, 2026 6:53pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored	Preview	Aug 9, 2026 6:53pm
petrinaut	Skipped		Aug 9, 2026 6:53pm

[cursor]

PR Summary

Low Risk
Single dependency bump with no application code changes; usage is the standard secure customAlphabet path with a constant positive size, though the major-version jump warrants a quick smoke test.

Overview
Bumps the nanoid dependency in hash-api from 3.3.11 to 5.1.16 to address CVE-2026-67214 (infinite loop in non-secure generators when given a negative size).

This is a dependency-only change; customAlphabet in index.ts (fixed alphabet and size 14 for request IDs) is unchanged. Reviewers should confirm install/build and that no transitive callers rely on removed v3 APIs.

^{Reviewed by Cursor Bugbot for commit 7c53b4a. Bugbot is set up for automated code reviews on this repo. Configure here.}

[claude]

Superseded by #9182, which takes nanoid to 3.3.17 instead of 5.1.16 (staying on the 3.x line closes both advisories without an ESM-only major) and regenerates yarn.lock.

[hash-dependencies]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update. You will not get PRs for any future 5.x releases. But if you manually upgrade to 5.x then Renovate will re-enable minor and patch updates automatically.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.