CVE-2026-33891: Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input
Vulnerability summary
CVE-2026-33891 is a high (CVSS 7.5) Loop with Unreachable Exit Condition vulnerability in digitalbazaar forge. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 49% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 2 · Related 1Timeline
- 27-03-2026PublishedVulnerability first disclosed.
- 04-09-2026Last modifiedVulnerability information updated.
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
CVSS metrics
6 scores · 6 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · NpmEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
0.61%
Chance of exploitation in the next 30 days
Percentile
49%
Versus all other CVEs
30-day change
Decrease -0.29 pp
From 0.90% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundForge
Maturity: poc
Weaknesses
CWE · root cause- CWE-835Loop with Unreachable Exit ConditionThe product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.
- CWE-606Unchecked Input for Loop ConditionThe product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.
Affected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Chainguard59 products
- arangodb-3.11< 3.11.14.4-r10
- arangodb-3.12< 3.12.9.4-r4
- gitlab-rails-ce-18.1< 18.1.6-r25
- gitlab-rails-ce-18.10All versions (No fix recorded)
- gitlab-rails-ce-18.11< 18.11.6-r7
Wolfi13 products
- katib-earlystopping< 0.19.0-r31
- katib-suggestion-goptuna-compatAll versions (No fix recorded)
- katib-suggestion-hyperband< 0.19.0-r31
- katib-suggestion-hyperopt< 0.19.0-r31 | < 0.19.0-r40
- katib-suggestion-nas-darts< 0.19.0-r31
Digitalbazaar1 product
- forge< 1.4.0 | ≤ 1.3.3
Npm1 product
- node-forge< 1.4.0
Ubuntu1 product
- node-node-forgeAll versions (No fix recorded)
5 vendors · 75 products
References
15 links- github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwxX Refsource CONFIRMREPORTAdvisoryWEBExploitVendor Advisory
- github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023X Refsource MISCREPORTFIXWEBPatch
