CVE-2026-118781: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
node-forgeto a version that resolves this vulnerability.Fixed in 1.4.1
Event History
Frequently Asked Questions
Are applications that only parse common key, certificate, or TLS formats exposed?
No. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger the infinite loop.
What attacker control is required to cause the denial of service?
An attacker must be able to control the RSA public exponent supplied to key generation or directly control an operand passed to modInverse(). A negative value or modulus is required to trigger the loop.
What happens when the issue is triggered?
The affected jsbn implementation enters an infinite loop, blocking the Node.js event loop at full CPU. This can cause denial of service for the affected process.
Which versions should be remediated?
The issue affects Forge versions prior to 1.4.1. Upgrade to version 1.4.1, which fixes the issue.