GitHub Advisoryadvisory · npm

GHSA-378v-28hj-76wf bn.js affected by an infinite loop

MEDIUM Published 2026-02-20 Modified 2026-02-24 Official page ↗
Aliases
CVE-2026-2739
Ecosystem
npm
Packages
bn.js
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-835
Reviewed
2026-02-20

Affected packages

• npm bn.js: < 4.12.3 → fixed in 4.12.3 • npm bn.js: >= 5.0.0, < 5.2.3 → fixed in 5.2.3

Description

This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Related

Alias · CVE (1)

  • CVE-2026-2739 This affects versions of the package bn.js before 5.2.3. vulnerability

Weakness · CWE (1)

  • CWE-835 Loop with Unreachable Exit Condition weakness

References