AIKIDO-2026-792646

TL;DR

The customAlphabet and customRandom generators in nanoid build an identifier inside a loop that only exits once the requested count of characters is produced. When these functions receive a size of 0, the loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that forwards an unvalidated, externally influenced size of 0 into these functions is exposed to a denial-of-service condition. The fix returns an empty string for a zero size so the loop terminates.