Vulnerabilities

Vulnerability · CVE-2026-118781

Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

Published Oct 29, 2026 · catalog updated Oct 30, 2026 · Forge: Denial of Service

Last checked Oct 31, 2026. A connected source was read within the last 7 days.

Check if you run it

No confirmed exploitation is on record for CVE-2026-118781. EPSS is 0.12%. Act only if a listed version of Forge: Denial of Service is installed.

Severity

Low2.9

Known exploitation

Not in CISA/VulnCheck KEV

EPSS

0.12%

Remediation

Version ranges on file

Affected products

npm node-forge · vendor digitalbazaar forge

### Summary in node-forge's bundled jsbn library enters an infinite loop when the value or the modulus is negative, for example when a negative public exponent is passed to . This is an incomplete fix of CVE-2026-33891 (GHSA-5m6q-g25r-mvwx), which handled only a zero value. Fixed in node-forge 1.4.1. ### Details ( , exposed as ) implements the binary extended Euclidean algorithm (Handbook of Applied Cryptography, Algorithm 14.61), which is defined for positive integers. With a negative operand the loop cannot terminate: is an arithmetic shift, so a negative value never moves towards zero, and the loop's exit condition ( reaching zero) is never met. The calling thread spins at 100% CPU indefinitely; in Node.js this blocks the event loop. Memory does not grow. node-forge 1.4.0 fixed CVE-2026-33891 (GHSA-5m6q-g25r-mvwx) by returning zero early when , although its changelog describes the check as "<= 0". Negative values were not covered, and a negative modulus was never handled. Every negative input that did terminate already returned zero. Within node-forge, RSA key generation is the only path to a negative operand: the caller's public exponent becomes , and is called with it. works on absolute values, so the coprimality checks pass and the loop is reached. Any exponent other than 3 or 65537 uses the pure JavaScript implementation, even when is not set. RFC 8017, Section 3.1 requires the RSA public exponent to be at least 3. Values that node-forge parses (DER, PEM, JWK, PKCS#12, X.509, TLS) are always read as unsigned integers and cannot produce a negative operand. The fix makes return zero when the value or the modulus is zero or negative, as it already does when no inverse exists. Results for positive inputs are unchanged. This issue was reported by wzc. ### Patches Fixed in node-forge 1.4.1. now returns zero when the value or the modulus is zero or negative. ### Workarounds - Pass only fixed, valid RSA public exponents (e.g. 65537) to key generation, or validate cal