diff --git a/‎index.cjs‎
Lines changed: 12 additions & 7 deletions b/‎index.cjs‎
Lines changed: 12 additions & 7 deletions
diff --git a/‎index.js‎
Lines changed: 1 addition & 1 deletion b/‎index.js‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎test/index.test.cjs‎
Lines changed: 17 additions & 4 deletions b/‎test/index.test.cjs‎
Lines changed: 17 additions & 4 deletions
@@ -12,13 +12,18 @@ let pool, poolOffset
 
 let fillPool = bytes => {
   if (bytes < 0 || bytes > 1024) throw new RangeError('Wrong ID size')
-  if (!pool || pool.length < bytes) {
-    pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER)
-    crypto.randomFillSync(pool)
-    poolOffset = 0
-  } else if (poolOffset + bytes > pool.length) {
-    crypto.randomFillSync(pool)
-    poolOffset = 0
+  try {
+    if (!pool || pool.length < bytes) {
+      pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER)
+      crypto.randomFillSync(pool)
+      poolOffset = 0
+    } else if (poolOffset + bytes > pool.length) {
+      crypto.randomFillSync(pool)
+      poolOffset = 0
+    }
+  } catch (e) {
+    pool = undefined
+    throw e
   }
   poolOffset += bytes
 }
 
@@ -11,7 +11,7 @@ const POOL_SIZE_MULTIPLIER = 128
 let pool, poolOffset
 
 let fillPool = bytes => {
-  if (bytes < 0) throw new RangeError('Wrong ID size')
+  if (bytes < 0 || bytes > 1024) throw new RangeError('Wrong ID size')
   try {
     if (!pool || pool.length < bytes) {
       pool = Buffer.allocUnsafe(bytes * POOL_SIZE_MULTIPLIER)
 
@@ -1,9 +1,14 @@
 let { test } = require('uvu')
-let { is, ok, equal, match, not } = require('uvu/assert')
+let { is, ok, equal, match, not, throws } = require('uvu/assert')
 
 let browser = require('../index.browser.js')
+let nodeCjs = require('../index.cjs')
 let node = require('../index.js')
 
+// `index.js` and `index.cjs` are two entries of the same package.
+// They must behave identically, so both are tested here.
+let entries = { browser, cjs: nodeCjs, node }
+
 test.before(() => {
   global.crypto = {
     getRandomValues(array) {
@@ -19,9 +24,9 @@ test.after(() => {
   delete global.crypto
 })
 
-for (let type of ['node', 'browser']) {
+for (let type of ['node', 'cjs', 'browser']) {
   let { nanoid, customAlphabet, customRandom, random, urlAlphabet } =
-    type === 'node' ? node : browser
+    entries[type]
 
   test(`${type} / nanoid / generates URL-friendly IDs`, () => {
     for (let i = 0; i < 100; i++) {
@@ -176,7 +181,15 @@ for (let type of ['node', 'browser']) {
     }
   })
 
-  if (type === 'node') {
+  if (type !== 'browser') {
+    test(`${type} / nanoid / limits ID size`, () => {
+      is(nanoid(1024).length, 1024)
+      throws(() => nanoid(1025), /Wrong ID size/)
+      throws(() => random(1025), /Wrong ID size/)
+      // A refused ID must not break the pool for the next request.
+      is(nanoid().length, 21)
+    })
+
     test(`${type} / proxy number / prevent collision`, () => {
       let makeProxyNumberToReproducePreviousID = () => {
         let step = 0