npm / nanoid
nanoid
What changed in nanoid 3 to 6, from its official release notes, upgrade guides and advisories. Sources checked 2026-10-17.
1 breaking3 security1 new APIs and options6 performance10 fixes and other
See which of these apply to your code, ranked, in your agent:
npx @unstale/cli initnanoid 66 changes
Breaking changes 1
Support for Node.js 18 and 20 was removed.
Performance 4
The JavaScript bundle size was reduced, which can benefit applications that bundle nanoid.
Improved customRandom performance when changing the requested size.
customAlphabet generation is 4 times faster.
nanoid generation is 4 times faster.
Fixes and other changes 1
Fixed handling of floating-point size values passed to customRandom.
nanoid 510 changes
Security 2
Fixed an infinite loop when size is negative.
nanoid: Integer Overflow or Wraparound
New APIs and options 1
The CLI now supports --version for displaying the installed nanoid version.
Performance 1
Made cusatomAlphabet 75% faster, improving performance for developers using it.
Fixes and other changes 6
Fixed random pool corruption on big ID sizes, improving ID generation reliability.
Fixed a regression that increased the size of the npm package.
Fixed a breaking issue when requesting a big ID.
Fixed nanoid breaking when requesting a big ID.
Type definitions for customRandom were fixed, improving type-checking for users of that API.
The nanoid.js distribution file was updated for CDN use.
nanoid 35 changes
Security 1
nanoid: custom generators can loop indefinitely when size is zero
Performance 1
Reduced npm package size, which may decrease installation and distribution overhead.
Fixes and other changes 3
Fixed types for developers using nanoid.
Fixed an issue where setting a huge user ID could kill the app.
Fixed an infinite loop when the requested size is zero.