CVE-2026-33891: node-forge Denial of Service via Infinite Loop in BigInteger.modInverse()
Summary
CVE-2026-33891: Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input. Affects node-forge versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
node-forge is a widely used cryptographic library in JavaScript that provides various functionalities for secure communications, including encryption, decryption, and digital signatures. It is particularly popular in Node.js applications due to its ease of use and comprehensive feature set. However, the library has a critical vulnerability that affects its BigInteger.modInverse() function, which can lead to a Denial of Service (DoS) when provided with a zero input.
Vulnerability Detail
The vulnerability arises from an infinite loop in the BigInteger.modInverse() function, which is part of the bundled jsbn library. When this function is called with a zero value as input, it enters an unreachable exit condition in the Extended Euclidean Algorithm, causing the process to hang indefinitely and consume 100% CPU resources. This can lead to a complete Denial of Service, making the application unresponsive to all requests. The vulnerability affects all versions of node-forge, as there is no input validation for zero values in the modInverse() function.
How To Fix
Latest published version: 1.4.0 as of 22 Oct 2026
npm install node-forge@1.4.0The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If you cannot immediately update the package, you can implement a workaround by ensuring that any input passed to the
modInverse() function is validated to be non-zero. For example, you can add a check before calling modInverse(): if (inputValue === 0) { throw new Error('Input must not be zero');
}
Conclusion
The node-forge library has a critical Denial of Service vulnerability due to an infinite loop in the BigInteger.modInverse() function when called with a zero input. It is essential to update to version 1.4.0 or later to mitigate this risk. Additionally, implementing input validation can help prevent this issue in the interim.
See every vulnerability recorded for node-forge →
FAQ
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
All versions of node-forge are affected by this vulnerability, including the latest version at the time of writing.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Without requiring access to the code or installation, Vulert uses just package-lock.json to check for vulnerabilities.
If you cannot update the package, implement input validation to ensure that zero values are not passed to the modInverse() function.
Yes, a proof of concept is available that demonstrates the infinite loop when calling BigInteger(0).modInverse(3). You can run the provided script to confirm the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for node-forge.
