AIKIDO-2026-347393

TL;DR

The customAlphabet and nanoid generators in the non-secure module of nanoid decrement a loop counter until it reaches zero to build an identifier. When these functions receive a negative size, the counter starts below zero and the while (i--) loop never reaches its termination condition, spinning indefinitely and hanging the calling thread. An application that forwards an unvalidated, externally influenced negative size into these functions is exposed to a denial-of-service condition. The fix guards the loop with i-- > 0 so a negative size produces an empty string instead of looping forever.