CVE-2026-33891highCWE-606CWE-835

CVE-2026-33891: high-severity vulnerability in digitalbazaar forge

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Published · Updated

Follow this CVE+ Monitor forge+ Monitor node-forge

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.5epss 0.6%
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected products
digitalbazaar · forge
Related CVEs — digitalbazaar forge

In the same product, most dangerous first.

CVE-2022-24772HIGHImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.1%CVE-2022-24773MEDIUMImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.0%CVE-2022-24771HIGHImproper Verification of Cryptographic Signature in node-forgeEPSS 0.8%CVE-2026-118779HIGHForge: Regular expression denial of service in PEM decoding (pem.decode)EPSS 0.6%CVE-2026-33895HIGHForge has signature forgery in Ed25519 due to missing S > L checkEPSS 0.5%CVE-2026-33894HIGHForge has signature forgery in RSA-PKCS due to ASN.1 extra fieldEPSS 0.5%