CVE-2026-73086: 
Grafana vulnerability analysis and mitigation

CVE-2026-73086 is an integer overflow vulnerability in the nanoid JavaScript library that permanently corrupts the process-wide Cryptographically Secure Pseudo-Random Number Generator (CSPRNG) pool, causing all subsequent ID generation to produce the deterministic string "uuuuuuuuuuuuuuuuuuuuu". It affects nanoid versions prior to 3.3.12 (all ≤ 3.3.11) and versions 4.0.0 through 5.1.10. The vulnerability was disclosed on August 11, 2026, with patches released in versions 3.3.12 and 5.1.11. It carries a CVSS v3.1 base score of 7.4 (High) (GitHub Advisory, Red Hat).

The root cause is an integer overflow (CWE-190) combined with use of a predictable algorithm in the random number generator (CWE-1241). The nanoid(size) function coerces the size parameter using size |= 0, converting it to a signed 32-bit integer; a value of 2147483648 (2^31) wraps to -2147483648. This negative value is passed to fillPool(), where neither conditional branch triggers (since -2147483648 is less than the pool length), so the pool is never refreshed and poolOffset is decremented by ~2.1 billion. Subsequent nanoid() calls index into the pool at deeply negative offsets, where pool[negative_index] returns undefined; undefined & 63 evaluates to 0; and urlAlphabet[0] is 'u' — making every generated ID the fixed string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts or ~100 million calls wrap poolOffset back to positive. A public proof-of-concept is included in the official advisory (GitHub Advisory).

Successful exploitation causes complete loss of ID unpredictability and uniqueness across the entire Node.js process from a single request. All session tokens, CSRF tokens, API keys, and database identifiers generated after the attack become identical and predictable ("uuuuuuuuuuuuuuuuuuuuu"), enabling an attacker to predict tokens issued to other users and perform session hijacking, authentication bypass, and CSRF attacks. The corruption is persistent across requests and affects all consumers of nanoid within the same process, with high confidentiality and integrity impact (GitHub Advisory, Feedly).

A public proof-of-concept is included in the official GitHub Security Advisory, demonstrating the overflow with a single call to nanoid(2147483648). No in-the-wild exploitation has been observed as of the disclosure date, and the NVD SSVC assessment confirms exploitation status as "none" (GitHub Advisory). The EPSS score is approximately 0.296%, reflecting low but non-zero probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the ability to send a network request with a user-controlled size parameter to an application that passes it directly to nanoid(), making it conditionally exploitable (CVSS Attack Complexity: High) (Feedly).

1. Reconnaissance: Identify target applications that use the nanoid npm package (versions ≤ 3.3.11 or 4.0.0–5.1.10) and expose an API endpoint that accepts a user-controlled size or length parameter (e.g., URL shortener slug length, configurable token size).
2. Craft overflow payload: Prepare an HTTP request that passes the value 2147483648 (2^31) as the size parameter to the vulnerable endpoint — for example, GET /api/generate?size=2147483648 or equivalent POST body.
3. Trigger the integer overflow: Send the crafted request to the target. The nanoid(2147483648) call coerces the value to -2147483648 via size |= 0, corrupting poolOffset in fillPool() process-wide. The call may throw an error or silently corrupt state depending on the version.
4. Confirm CSPRNG corruption: Send subsequent requests that cause the application to generate new session tokens, CSRF tokens, or API keys. Observe that all generated IDs are now the fixed string "uuuuuuuuuuuuuuuuuuuuu".
5. Exploit predictable tokens: Use the known deterministic token value to forge session cookies, bypass CSRF protections, or impersonate other users by submitting "uuuuuuuuuuuuuuuuuuuuu" as a valid token in authentication or state-changing requests (GitHub Advisory).

• Network: Inbound HTTP requests containing a size, length, or similar parameter with the value 2147483648 targeting ID/token generation endpoints.
• Logs: Application logs showing requests with extremely large integer values for size parameters; error logs showing RangeError or silent exceptions from nanoid() calls with oversized inputs (in unpatched versions, errors may be swallowed).
• Application Behavior: Session tokens, CSRF tokens, or API keys observed in logs or responses that are consistently the string uuuuuuuuuuuuuuuuuuuuu — a strong indicator of active CSPRNG pool corruption.
• Authentication Logs: Multiple successful authentications or CSRF validations using the token value uuuuuuuuuuuuuuuuuuuuu, indicating token forgery exploitation (GitHub Advisory).

Upgrade nanoid to version 3.3.12 or 5.1.11 (or later), which add a bounds check in fillPool() that throws a RangeError('Wrong ID size') for any size value less than 0 or greater than 1024, preventing the overflow (nanoid 3.3.12 Release, GitHub Advisory). As an immediate workaround prior to patching, validate and sanitize any user-supplied size parameter before passing it to nanoid(), ensuring it is a positive integer within a reasonable range. After patching, review and regenerate any session tokens, CSRF tokens, API keys, and unique identifiers that may have been generated while the vulnerability was active (Red Hat).

Red Hat tracked the vulnerability and issued an errata (RHSA-2026:54518) for affected Red Hat products that bundle nanoid (Red Hat Errata). AusCERT published two bulletins (ESB-2026.9471 and ESB-2026.9567) alerting its constituency. The vulnerability was reported by researcher alanzabihi and credited in the official GitHub Security Advisory (GitHub Advisory). Community reaction has been moderate, with security aggregators such as VulDB, INCIBE-CERT, and Tenable Nessus (plugin 334674) picking up the advisory shortly after disclosure.