GHSA-378v-28hj-76wf
bn.js affected by an infinite loop
At a glance
- Published
- Updated
- CVE
- CVE-2026-2739
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Description
This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
Affected packages
| Package | Versions |
|---|---|
| npm · bn.js | introduced 0, fixed 4.12.3 |
| npm · bn.js | introduced 5.0.0, fixed 5.2.3 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2026-2739 ADVISORY
- https://github.com/indutny/bn.js/issues/186 WEB
- https://github.com/indutny/bn.js/issues/316 WEB
- https://github.com/indutny/bn.js/issues/316#issuecomment-3924217358 WEB
- https://github.com/indutny/bn.js/pull/317 WEB
- https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b WEB
- https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91 WEB
- https://github.com/indutny/bn.js PACKAGE
- https://github.com/indutny/bn.js/releases/tag/v5.2.3 WEB
- https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |