CVE-2026-33891: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in digitalbazaar forge
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
AI Analysis
Technical Summary
The node-forge library, a JavaScript implementation of Transport Layer Security, contains a denial of service vulnerability (CVE-2026-33891) due to an infinite loop in the BigInteger.modInverse() function inherited from the bundled jsbn library. When modInverse() is invoked with zero as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume full CPU resources. This issue affects all versions prior to 1.4.0. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. The vendor has released version 1.4.0 which patches this issue. Red Hat advisories confirm the vulnerability and provide updates for affected products.
Potential Impact
Exploitation of this vulnerability results in a denial of service condition where the affected process enters an infinite loop, consuming 100% CPU and hanging indefinitely. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade to node-forge version 1.4.0 or later, where this infinite loop vulnerability in BigInteger.modInverse() has been fixed. Red Hat has issued security advisories and updates for their affected products incorporating this fix. Applying these official patches or updates will remediate the issue.
CVE-2026-33891: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in digitalbazaar forge
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The node-forge library, a JavaScript implementation of Transport Layer Security, contains a denial of service vulnerability (CVE-2026-33891) due to an infinite loop in the BigInteger.modInverse() function inherited from the bundled jsbn library. When modInverse() is invoked with zero as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume full CPU resources. This issue affects all versions prior to 1.4.0. The vulnerability has a CVSS 3.1 base score of 7.5, indicating high severity. The vendor has released version 1.4.0 which patches this issue. Red Hat advisories confirm the vulnerability and provide updates for affected products.
Potential Impact
Exploitation of this vulnerability results in a denial of service condition where the affected process enters an infinite loop, consuming 100% CPU and hanging indefinitely. This impacts availability but does not affect confidentiality or integrity. There are no known exploits in the wild at this time.
Mitigation Recommendations
Upgrade to node-forge version 1.4.0 or later, where this infinite loop vulnerability in BigInteger.modInverse() has been fixed. Red Hat has issued security advisories and updates for their affected products incorporating this fix. Applying these official patches or updates will remediate the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-03-24T15:10:05.682Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-33891","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24761","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:24762","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:9742","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:13826","vendor":"Red Hat"}]
Threat ID: 69c6efce3c064ed76ff462e1
Added to database: 03/27/2026, 20:59:58 UTC
Last enriched: 07/15/2026, 13:22:55 UTC
Last updated: 07/31/2026, 19:22:58 UTC
Views: 229
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.