nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values.
Priority LOW 21CWE-835Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Partial Red Hat: 28 fixed, 27 without a fix
Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-835.
Summary
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00665 52nd percentileScored 2026-11-07
Fix Partial nanoid (npm): 5.0.9, 3.3.8Red Hat: 25 advisoriesRed Hat: 28 fixed, 27 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | nanoid (npm) | 4.0.0 to before 5.0.9 | 5.0.9 | Patch available | GHSA-mwcw-c2x4-8c55 |
| — | nanoid (npm) | before 3.3.8 | 3.3.8 | Patch available | GHSA-mwcw-c2x4-8c55 |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- nanoid (npm) Vendor— Affected 4.0.0 to before 5.0.9 Fixed in 5.0.9 Patch available GHSA-mwcw-c2x4-8c55
- nanoid (npm) Vendor— Affected before 3.3.8 Fixed in 3.3.8 Patch available GHSA-mwcw-c2x4-8c55
Remediation
- Fix · GHSA-mwcw-c2x4-8c55 nanoid (npm) Fixed in 5.0.9 Advisory →
- Fix · GHSA-mwcw-c2x4-8c55 nanoid (npm) Fixed in 3.3.8 Advisory →
Red Hat 25 advisories
- RHSA-2026:86618 Released 2026-10-21 · Red Hat rating CriticalNew container image: rhceph-9.2
- Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
- RHSA-2026:33154 Released 2026-06-29 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:26411 Released 2026-06-16 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9.0 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
Show 22 more Red Hat advisories
- RHSA-2026:3406 Released 2026-02-26 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
- RHSA-2026:2769 Released 2026-02-17 · Red Hat rating ImportantRed Hat Ceph Storage 7.1 security and bug fix updates
- Red Hat Ceph Storage 7.1 Tools ceph-2:18.2.1-381.el8cp, ceph-2:18.2.1-381.el9cp, ceph-base-2:18.2.1-381.el8cp +47
- RHSA-2026:2737 Released 2026-02-16 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
- RHSA-2025:3397 Released 2025-03-31 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:3374 Released 2025-03-27 · Red Hat rating ImportantRed Hat Developer Hub 1.5.1 release.
- Red Hat Developer Hub 1.5 registry.redhat.io/rhdh/rhdh-hub-rhel9, registry.redhat.io/rhdh/rhdh-rhel9-operator
- RHSA-2025:3368 Released 2025-03-27 · Red Hat rating ImportantRHOAI 2.16.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +13
- RHSA-2025:2652 Released 2025-03-11 · Red Hat rating ImportantRHODF-4.18-RHEL-9 enhancement, bug fix and security update
- RHODF 4.18 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/ocs-metrics-exporter-rhel9 +3
- RHSA-2024:6121 Released 2025-02-25 · Red Hat rating ImportantOpenShift Container Platform 4.18.1 security and extras update
- Red Hat OpenShift Container Platform 4.18 openshift4/ingress-node-firewall-rhel9, openshift4/ingress-node-firewall-rhel9-operator, openshift4/kube-compare-artifacts-rhel9 +47
- RHSA-2025:1448 Released 2025-02-13 · Red Hat rating ImportantRHOAI 2.17.0 - Red Hat OpenShift AI
- Red Hat OpenShift AI 2.17 registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-operator-controller-rhel8 +5
- RHSA-2025:1249 Released 2025-02-10 · Red Hat rating Importantupdated discovery container images
- Discovery 1 for RHEL 9 discovery/discovery-server-rhel9, discovery/discovery-ui-rhel9
- RHSA-2025:0875 Released 2025-02-05 · Red Hat rating ImportantOpenShift Container Platform 4.17.15 security and extras update
- Red Hat OpenShift Container Platform 4.17 openshift4/nmstate-console-plugin-rhel9, openshift4/ose-ansible-rhel9-operator, openshift4/ose-helm-rhel9-operator +2
- RHSA-2025:1051 Released 2025-02-05 · Red Hat rating ImportantRed Hat OpenShift Service Mesh Containers for 2.5.8
- RHOSSM 2.5 for RHEL 8 openshift-service-mesh/kiali-ossmc-rhel8, openshift-service-mesh/kiali-rhel8, openshift-service-mesh/proxyv2-rhel8
- RHSA-2025:0892 Released 2025-02-03 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.18.0 release
- Red Hat OpenShift Dev Spaces 3 devspaces/code-rhel9, devspaces/dashboard-rhel9, devspaces/devspaces-rhel9-operator +1
- RHSA-2025:0851 Released 2025-01-30 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.12.2 security and bug fix updates
- Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 rhacm2/acm-cli-rhel9, rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9 +43
- RHSA-2025:0785 Released 2025-01-28 · Red Hat rating ImportantRed Hat Advanced Cluster Management 2.11.5 bug fixes and container updates
- Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 rhacm2/acm-cluster-permission-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9 +40
- RHSA-2025:0778 Released 2025-01-28 · Red Hat rating ImportantMulticluster Engine for Kubernetes 2.6.5 security updates and bug fixes
- multicluster engine for Kubernetes 2.6 for RHEL 8 multicluster-engine/assisted-image-service-rhel8, multicluster-engine/assisted-installer-agent-rhel8, multicluster-engine/assisted-installer-controller-rhel8 +2
- multicluster engine for Kubernetes 2.6 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/backplane-rhel9-operator +27
- RHSA-2025:0654 Released 2025-01-28 · Red Hat rating ImportantOpenShift Container Platform 4.17.14 bug fix and security update
- Red Hat OpenShift Container Platform 4.17 openshift4/oc-mirror-plugin-rhel9, openshift4/ose-agent-installer-api-server-rhel9, openshift4/ose-baremetal-cluster-api-controllers-rhel9 +6
- RHSA-2025:0723 Released 2025-01-27 · Red Hat rating ImportantMulticluster Engine for Kubernetes 2.7.3 security updates and bug fixes
- multicluster engine for Kubernetes 2.7 for RHEL 8 multicluster-engine/assisted-service-8-rhel8
- multicluster engine for Kubernetes 2.7 for RHEL 9 multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-image-service-rhel9, multicluster-engine/assisted-installer-agent-rhel9 +31
- RHSA-2025:0340 Released 2025-01-15 · Red Hat rating ImportantRed Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
- Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.6-1.el8ap, automation-gateway-server-2.5.20250115-1.el8ap, python3.11-aiohttp-3.10.11-1.el8ap
- Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.6-1.el9ap, automation-gateway-server-2.5.20250115-1.el9ap, python3.11-aiohttp-3.10.11-1.el9ap
- RHSA-2024:10990 Released 2025-01-15 · Red Hat rating ModerateLogging for Red Hat OpenShift - 5.9.10
- RHOL 5.9 for RHEL 9 openshift-logging/cluster-logging-operator-bundle, openshift-logging/cluster-logging-rhel9-operator, openshift-logging/eventrouter-rhel9 +9
- RHSA-2025:0082 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.16.5 Bug Fix Update
- RHODF 4.16 for RHEL 9 odf4/cephcsi-rhel9, odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9 +1
- RHSA-2025:0079 Released 2025-01-08 · Red Hat rating ImportantRed Hat OpenShift Data Foundation 4.17.2 Bug Fix Update
- RHODF 4.17 for RHEL 9 odf4/ocs-client-console-rhel9, odf4/odf-console-rhel9, odf4/odf-multicluster-console-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Cryostat 3 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Applications 7 | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Containers | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix yet: Fix deferred |
| Node HealthCheck Operator | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet |
| OpenShift Pipelines | Affected | No fix planned: Will not fix |
| OpenShift Service Mesh 2 | Affected | No fix yet |
| Red Hat 3scale API Management Platform 2 | Affected | No fix planned: Will not fix |
| Red Hat Advanced Cluster Security 4 | Affected | No fix planned: Will not fix |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Connectivity Link 1 | Affected | No fix yet: Fix deferred |
| Red Hat Data Grid 8 | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Data Science (RHODS) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Dev Spaces | Affected | No fix yet |
| Red Hat OpenShift GitOps | Affected | No fix yet |
| Red Hat OpenShift Virtualization 4 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Red Hat build of Apicurio Registry 2 | Affected | No fix yet |
| Red Hat build of OptaPlanner 8 | Affected | No fix yet |
| streams for Apache Kafka | Affected | No fix planned: Out of support scope |
| Discovery 1 for RHEL 9 | Fixed | RHSA-2025:1249 |
| Quay v3 | Fixed | — |
| RHODF 4.16 for RHEL 9 | Fixed | RHSA-2025:0082 |
| RHODF 4.17 for RHEL 9 | Fixed | RHSA-2025:0079 |
| RHODF 4.18 for RHEL 9 | Fixed | RHSA-2025:2652 |
| RHOL 5.9 for RHEL 9 | Fixed | RHSA-2024:10990 |
| RHOSSM 2.5 for RHEL 8 | Fixed | RHSA-2025:1051 |
| Red Hat Advanced Cluster Management for Kubernetes 2.11 for RHEL 9 | Fixed | RHSA-2025:0785 |
| Red Hat Advanced Cluster Management for Kubernetes 2.12 for RHEL 9 | Fixed | RHSA-2025:0851 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 8 | Fixed | RHSA-2025:0340 |
| Red Hat Ansible Automation Platform 2.5 for RHEL 9 | Fixed | RHSA-2025:0340 |
| Red Hat Ceph Storage 7.1 | Fixed | RHSA-2026:33154 |
| Red Hat Ceph Storage 7.1 Tools | Fixed | RHSA-2026:2769 |
| Red Hat Ceph Storage 8 | Fixed | RHSA-2026:2737 |
| Red Hat Ceph Storage 9 | Fixed | RHSA-2026:3406 |
| Red Hat Ceph Storage 9.0 | Fixed | RHSA-2026:26411 |
| Red Hat Ceph Storage 9.2 | Fixed | RHSA-2026:86618 |
| Red Hat Developer Hub (RHDH) 1.4 | Fixed | — |
| Red Hat Developer Hub 1.5 | Fixed | RHSA-2025:3374 |
| Red Hat OpenShift AI 2.16 | Fixed | RHSA-2025:3368 |
| Red Hat OpenShift AI 2.17 | Fixed | RHSA-2025:1448 |
| Red Hat OpenShift Container Platform 4.17 | Fixed | RHSA-2025:0654, RHSA-2025:0875 |
| Red Hat OpenShift Container Platform 4.18 | Fixed | RHSA-2024:6121 |
| Red Hat OpenShift Dev Spaces 3 | Fixed | RHSA-2025:0892 |
| multicluster engine for Kubernetes 2.6 for RHEL 8 | Fixed | RHSA-2025:0778 |
| multicluster engine for Kubernetes 2.6 for RHEL 9 | Fixed | RHSA-2025:0778 |
| multicluster engine for Kubernetes 2.7 for RHEL 8 | Fixed | RHSA-2025:0723 |
| multicluster engine for Kubernetes 2.7 for RHEL 9 | Fixed | RHSA-2025:0723 |
Not affected: 30 products
- RHODF 4.16 for RHEL 9
- RHODF 4.17 for RHEL 9
- RHODF 4.18 for RHEL 9
- RHOSSM 2.5 for RHEL 8
- Red Hat Advanced Cluster Security 4
- Red Hat Ansible Automation Platform 2.5 for RHEL 8
- Red Hat Ansible Automation Platform 2.5 for RHEL 9
- Red Hat Build of Keycloak
- Red Hat Ceph Storage 7.1
- Red Hat Ceph Storage 8
- Red Hat Ceph Storage 9
- Red Hat Ceph Storage 9.0
- Red Hat Ceph Storage 9.2
- Red Hat Developer Hub (RHDH) 1.4
- Red Hat Developer Hub 1
- Red Hat Developer Hub 1.5
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 2.16
- Red Hat OpenShift AI 2.17
- Red Hat OpenShift Container Platform 4.17
- Red Hat OpenShift Data Science (RHODS)
- Red Hat OpenShift Dev Spaces 3
- Red Hat Openshift Data Foundation 4
- Red Hat Satellite 6
- Red Hat Trusted Artifact Signer
- Red Hat build of Apache Camel - HawtIO 4
Timeline
- 2026-10-02 Threatist record created from CVE-2024-55565
- 2026-10-03 Alias added: GHSA-mwcw-c2x4-8c55
- 2026-10-04 EPSS moved to the 50th–90th percentile
- 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
- 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
Other 6
Sources
- CVE-2024-55565 · CVE Program
- CVE-2024-55565 · NVD
- FIRST EPSS
- GHSA-mwcw-c2x4-8c55 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-55565 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences