medium5.3
CVE-2026-2739
bn.js affected by an infinite loop
Impact
This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | bn.js | < 4.12.3 | 4.12.3 |
Affected products
| Product | Affected versions |
|---|---|
| Package Bn.Js | before 5.2.3. |
Versions were read from the advisory text. No structured product data has been published for this record yet.
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91
- https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b
- https://github.com/indutny/bn.js/issues/186
- https://github.com/indutny/bn.js/issues/316
- https://github.com/indutny/bn.js/pull/317
- https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301
- https://github.com/advisories/GHSA-378v-28hj-76wf
- https://nvd.nist.gov/vuln/detail/CVE-2026-2739
- https://github.com/indutny/bn.js/releases/tag/v5.2.3
- https://github.com/indutny/bn.js/issues/316#issuecomment-3924217358