nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions. When these functions are configured with a size of 0, the internal generation loop never satisfies its exit condition and spins indefinitely, hanging the calling thread. An application that passes an unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.

The version of Atlassian Confluence Server running on the remote host is affected by a vulnerability as referenced in the CONFSERVER-104513 advisory.

  - nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.
    When these functions are configured with a size of 0, the internal generation loop never satisfies its     exit condition and spins indefinitely, hanging the calling thread. An application that passes an     unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
    (CVE-2026-67213)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Atlassian Jira Service Management Data Center and Server (Jira Service Desk) running on the remote host is affected by a vulnerability as referenced in the JSDSERVER-16833 advisory.

  - nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.
    When these functions are configured with a size of 0, the internal generation loop never satisfies its     exit condition and spins indefinitely, hanging the calling thread. An application that passes an     unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
    (CVE-2026-67213)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its self-reported version number, the Atlassian Crowd application running on the remote host is prior to 7.2.3. It is, therefore, affected by multiple vulnerabilities, including flaws in bundled third-party dependencies :

- Multiple denial of service vulnerabilities in the bundled Apache Tomcat dependency. (CVE-2026-58059, CVE-2026-13506)

- Multiple broken authentication and session management vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-12803, CVE-2026-59639, CVE-2026-59642, CVE-2026-12802, CVE-2026-12816)

- A remote code execution vulnerability in the bundled form-data dependency. (CVE-2026-12143)

- Multiple remote code execution vulnerabilities in the bundled Bouncy Castle dependency. (CVE-2026-58060, CVE-2026-14682)

- Multiple denial of service vulnerabilities in the bundled nanoid dependency. (CVE-2026-67214, CVE-2026-67213)

- A file inclusion vulnerability in the bundled postcss dependency. (CVE-2026-73646)

- A denial of service vulnerability in the bundled Netty dependency. (CVE-2026-73507)

- A cross-site request forgery (CSRF) vulnerability in the bundled nanoid dependency. (CVE-2026-73086)

- A broken authentication and session management vulnerability in the bundled Apache Tomcat dependency. (CVE-2026-53404)

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-3942ab86fd advisory.

    See https://github.com/jupytext/jupytext/blob/main/CHANGELOG.md for changes in versions 1.19.5 and 1.19.6.
    For this update, a patch has been applied that reverses the jupyterlab  jupyter-builder change for     Fedora releases  45, since jupyter-builder is only available in F46 and later.  Many CVEs have been     fixed in this release.


Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.
    When these functions are configured with a size of 0, the internal generation loop never satisfies its
    exit condition and spins indefinitely, hanging the calling thread. An application that passes an
    unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
    (CVE-2026-67213)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nanoid (Nano ID) before 5.1.6 contains an infinite loop in the customAlphabet and customRandom functions.
    When these functions are configured with a size of 0, the internal generation loop never satisfies its     exit condition and spins indefinitely, hanging the calling thread. An application that passes an     unvalidated, attacker-controlled size of 0 to these functions is exposed to a denial-of-service condition.
    (CVE-2026-67213)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
368959	Atlassian Confluence < 9.2.22 / 9.3.x < 10.2.19 / 11.0.0 (CONFSERVER-104513)	Nessus	CGI abuses	Combined	high
367872	Atlassian Jira Service Management Data Center and Server 10.0.x < 10.3.26 / 10.4.x < 11.3.12 (JSDSERVER-16833)	Nessus	Misc.	Local	high
115705	Atlassian Crowd < 7.2.3 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	Version Based	high
365513	Fedora 43 : python-jupytext (2026-3942ab86fd)	Nessus	Fedora Local Security Checks	Local	high
465202	Echo: nanoid: security update to 3.3.18	Tenable Cloud Security	Echo Local Security Checks	Local	high
465202	Echo: nanoid: security update to 3.3.18	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
445948	SCA: security update for nanoid (GHSA-2v37-7h3g-55p8)	Tenable Cloud Security	SCA Checks	Local	high
445948	SCA: security update for nanoid (GHSA-2v37-7h3g-55p8)	Tenable Self-Hosted Container Security	SCA Checks	Local	high
330739	Linux Distros Unpatched Vulnerability : CVE-2026-67213	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-67213

high

Tenable Plugins

high

high

high

high

high

high

high

high

high