CVE-2026-118781: fallo de gravedad baja en digitalbazaar forge
Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
8Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 2.9epss 0.1%
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
digitalbazaar · forgeCVEs relacionadas — digitalbazaar forge
En el mismo producto, de las más peligrosas a las menos.
CVE-2022-24772HIGHImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.1%CVE-2022-24773MEDIUMImproper Verification of Cryptographic Signature in `node-forge`EPSS 1.0%CVE-2022-24771HIGHImproper Verification of Cryptographic Signature in node-forgeEPSS 0.8%CVE-2026-33891HIGHForge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero InputEPSS 0.6%CVE-2026-118779HIGHForge: Regular expression denial of service in PEM decoding (pem.decode)EPSS 0.6%CVE-2026-33895HIGHForge has signature forgery in Ed25519 due to missing S > L checkEPSS 0.5%