CVE-2026-33891

HIGH 7.5

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.

CWE	CWE-835
Vendor	digitalbazaar
Product	forge
Published	Mar 27, 2026
Last Updated	Jul 15, 2026

Stay Ahead of the Next One

Get instant alerts for digitalbazaar forge

Be the first to know when new high vulnerabilities affecting digitalbazaar forge are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

digitalbazaar / forge

< 1.4.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx github.com: https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023 access.redhat.com: https://access.redhat.com/security/cve/CVE-2026-33891 bugzilla.redhat.com: https://bugzilla.redhat.com/show_bug.cgi?id=2452450 security.access.redhat.com: https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33891.json access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24761 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:24762 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:34342 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:9742 access.redhat.com: https://access.redhat.com/errata/RHSA-2026:13826