Description
Vulnerable Library - shortid-2.2.14.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nanoid/package.json
Found in HEAD commit: aa914de618a178424105cc38c474133a60c17eeb
Vulnerabilities
| Vulnerability | Severity |  CVSS |
Exploit Maturity | EPSS | Dependency | Type | Fixed in (shortid version) | Remediation Possible** | Reachability |
|---|---|---|---|---|---|---|---|---|---|
| CVE-2024-55565 |  Medium |
4.3 | Not Defined | 0.0% | nanoid-2.0.3.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2024-55565
Vulnerable Library - nanoid-2.0.3.tgz
A tiny (141 bytes), secure URL-friendly unique string ID generator
Library home page: https://registry.npmjs.org/nanoid/-/nanoid-2.0.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nanoid/package.json
Dependency Hierarchy:
- shortid-2.2.14.tgz (Root Library)
- ❌ nanoid-2.0.3.tgz (Vulnerable Library)
Found in HEAD commit: aa914de618a178424105cc38c474133a60c17eeb
Found in base branch: main
Vulnerability Details
nanoid (aka Nano ID) before 5.0.9 mishandles non-integer values. 3.3.8 is also a fixed version.
Publish Date: 2024-12-09
URL: CVE-2024-55565
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.0%
CVSS 3 Score Details (4.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Release Date: 2024-12-09
Fix Resolution: https://github.com/ai/nanoid.git - 3.3.8