CVE-2024-55565
mediumpriority · track · 0EPSS 0.007 · 51 %ileDEEUUSEPSS · scored 2026-10-22
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (26)
Products and version ranges known to be affected.
- Red Hat Enterprise Linux Advanced Cluster Security for Kubernetes 4all versionscert_bundDEcpe:/o:redhat:enterprise_linux:advanced_cluster_security_for_kubernetes_4
- Red Hat Enterprise Linux Edge Managerall versionscert_bundDEcpe:/o:redhat:enterprise_linux:edge_manager
- Red Hat OpenShift Container Platformall versionscert_bundDEcpe:/a:redhat:openshift:container_platform
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2025-0043IBM QRadar SIEM (Log Source Management App): Mehrere SchwachstellenDeutsch2025-01-12csaf · cert_bundDE
Ein entfernter anonymer Angreifer kann mehrere Schwachstellen in IBM QRadar SIEM ausnutzen, um einen Cross-Site-Scripting-Angriff zu starten, beliebigen Code auszuführen, einen Denial-of-Service-Zustand zu erzeugen, Daten zu manipulieren, vertrauliche Informationen offenzulegen und Sicherheitsmaßnahmen zu umgehen.
- WID-SEC-W-2025-0226Red Hat Enterprise Linux (Advanced Cluster Management): Mehrere SchwachstellenDeutsch2025-01-30csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux Advanced Cluster Management ausnutzen, um Sicherheitsmaßnahmen zu umgehen und einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2025-0504HCL BigFix WebUI Applications: Mehrere SchwachstellenDeutsch2025-03-06csaf · cert_bundDE
Ein anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in HCL BigFix ausnutzen, um Cross-Site-Scripting-Angriffe zu starten, Daten zu manipulieren und einen Denial-of-Service-Zustand zu verursachen.
- WID-SEC-W-2025-0930IBM Business Automation Workflow: Mehrere SchwachstellenDeutsch2025-05-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in IBM Business Automation Workflow ausnutzen, um einen Denial of Service Angriff durchzuführen, oder Informationen auszuspähen.
- GHSA-mwcw-c2x4-8c55Predictable results in nanoid generation when given non-integer values2024-12-09ghsa · osvUS
When nanoid is called with a fractional value, there were a number of undesirable effects: 1. in browser and non-secure, the code infinite loops on while (size--) 2. in node, the value of poolOffset becomes fractional, causing calls to nanoid to return zeroes until the pool is next filled 3. if the first call in node is a fractional argument, the initial buffer allocation fails with an error Version 3.3.8 and 5.0.9 are fixed.
also known as (3)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (12)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2024-55565cnnvd
- https://github.com/ai/nanoid/compare/3.3.7...3.3.8cnnvd
- https://github.com/ai/nanoid/pull/510cnnvd
- https://github.com/ai/nanoid/releases/tag/5.0.9cnnvd
- https://github.com/ai/nanoid/compare/3.3.7...3.3.8enisa_euvd
- https://github.com/ai/nanoid/pull/510enisa_euvd
- https://github.com/ai/nanoid/releases/tag/5.0.9enisa_euvd
- https://github.com/ai/nanoid/compare/3.3.7...3.3.8nvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan