CVE-2026-2739 — Infinite Loop in Node-bn.js
Severity
5.5MEDIUMNVD
EPSS
0.0%
top 94.28%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedFeb 20
Description
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Affected Packages2 packages
🔴Vulnerability Details
3📋Vendor Advisories
3Microsoft▶
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, han↗2026-02-10
Debian▶
CVE-2026-2739: node-bn.js - This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any...↗2026