Threats tagged 'ghsa-h6cr-wjv9-3cpp'

node-forge versions prior to 1.4.1 contain a denial of service vulnerability in the BigInteger.modInverse() function due to an infinite loop triggered by negative input values. This occurs when a negative value or modulus is passed, causing the function to spin indefinitely at 100% CPU and block the Node.js event loop. The issue is an incomplete fix of a previous vulnerability and affects RSA key generation when using negative public exponents. The vulnerability does not affect key parsing or standard usage with typical exponents like 65537. It was fixed in node-forge 1.4.1 by returning zero for zero or negative inputs.