CVE-2026-118781: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)

October 30, 2026

BigInteger.prototype.modInverse() in node-forge’s bundled jsbn library enters an infinite loop when the value or the modulus is negative, for example when a negative public exponent is passed to forge.pki.rsa.generateKeyPair(). This is an incomplete fix of CVE-2026-33891 (GHSA-5m6q-g25r-mvwx), which handled only a zero value. Fixed in node-forge 1.4.1.

References

github.com/advisories/GHSA-h6cr-wjv9-3cpp
github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72
github.com/digitalbazaar/forge/releases/tag/v1.4.1
github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp
nvd.nist.gov/vuln/detail/CVE-2026-118781

Code Behaviors & Features

Detect and mitigate CVE-2026-118781 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →