The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
nanoid is a secure, URL-friendly, unique string ID generator for JavaScript. Prior to versions 3.3.12 and 5.1.11, the nanoid(size) function in index.js and index.cjs coerces the user-influenced size parameter to a signed 32-bit integer, allowing a value of 2147483648 to become -2147483648 and corrupt the process-wide CSPRNG poolOffset in fillPool(), which causes subsequent session tokens, CSRF tokens, API keys, and unique identifiers to become the deterministic string "uuuuuuuuuuuuuuuuuuuuu" until the process restarts. This issue is fixed in versions 3.3.12 and 5.1.11.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | Sep 16, 2026 | Sep 15, 2026 |
| Debian | — | Upgrade node-mocha | Aug 12, 2026 | Aug 12, 2026 |
| Redhat_linux | — | Upgrade python3.12-django-ansible-base+oauth2_providerUpgrade python3.12-django-ansible-base+rest_filtersUpgrade automation-eda-controller-baseUpgrade automation-gateway-proxy-debugsourceUpgrade python3.12-gitpythonUpgrade automation-eda-controller-worker-servicesUpgrade automation-gatewayNo solution existsUpgrade automation-gateway-serverUpgrade python3.12-galaxy-ngUpgrade automation-hubUpgrade receptor-debugsourceUpgrade automation-controllerUpgrade receptorctlUpgrade python3.12-django-ansible-base+activitystreamUpgrade python3.12-django-ansible-base+authenticationUpgrade automation-controller-uiUpgrade python3.12-sqlparseUpgrade automation-gateway-proxy-serverUpgrade automation-gateway-configUpgrade python3.12-django-ansible-base+jwt_consumerUpgrade python3.12-django-ansible-base+resource_registryUpgrade python3.12-django-ansible-base+api_documentationUpgrade receptorUpgrade automation-controller-serverUpgrade python3.12-django-ansible-base+redis_clientUpgrade automation-eda-controller-base-servicesUpgrade python3.12-django-ansible-base+feature_flagsUpgrade python3.12-django-ansible-base+channel_authUpgrade automation-platform-uiUpgrade automation-controller-cliUpgrade python3-sqlparseUpgrade automation-controller-venv-towerUpgrade aap-metrics-utilityUpgrade receptor-debuginfoUpgrade automation-eda-controller-event-stream-servicesUpgrade python3.12-django-ansible-base+rbacUpgrade automation-gateway-proxyUpgrade automation-eda-controllerUpgrade python3.12-django-ansible-baseUpgrade automation-gateway-proxy-server-debuginfo | Aug 17, 2026 | Aug 11, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub