CVE-2026-33891

Aliases:GHSA-5m6q-g25r-mvwxCGA-2jfv-phwp-2vxwCGA-2rwm-32cv-x2x7CGA-32xp-wqfc-g9jrCGA-5h92-ph82-fvm7CGA-5jf7-3pjw-j3whCGA-5wqc-vvmm-9g42CGA-7cv5-xcr7-56r3CGA-9j78-5h4q-225rCGA-c656-fv8g-fvj8CGA-c6q4-9pxp-wcq9CGA-cj8m-c3hg-xp49CGA-f22j-4m6h-6j65CGA-hcr9-hgv2-p45gCGA-hw7g-wmmj-hcwgCGA-m74c-77cm-vrg4CGA-p9gm-c5x7-cr8cCGA-pvxp-gxwj-73jxCGA-23mv-wppg-fq2rCGA-2gqh-rgjc-5449CGA-2h4r-v749-x7w6CGA-2m4r-79p3-52cfCGA-2pjq-5rfq-7qj6CGA-2v3f-pf67-rj8gCGA-34wf-rcvc-2238CGA-36w3-xvw5-x64hCGA-3fw7-c9xc-3pf6CGA-3mq8-pcw3-fjcgCGA-3v5g-7phq-3w7mCGA-4989-f95j-3q46CGA-4q5j-366h-259xCGA-5756-fg3h-mq3cCGA-5hx8-fqqx-pm5xCGA-5j36-2x2q-r59wCGA-5mvj-56j4-m3qqCGA-5pww-46v7-7fv7CGA-64h5-pmv6-cqq3CGA-6753-gr2j-m92cCGA-679h-2c8h-4qjjCGA-69g7-w323-c64vCGA-6prw-4mgj-h6vqCGA-6xg8-7x3v-2cfgCGA-72xq-qc88-jf42CGA-7fv4-7j62-mrrfCGA-7q2j-r74q-7vcqCGA-7qjh-fpgx-244qCGA-7v24-h88g-75j2CGA-7wmm-w45j-fqwvCGA-84vm-83mx-3w5pCGA-86w8-rv46-p6mfCGA-8cj3-92vj-7g5hCGA-8g66-q536-4fhgCGA-8m94-mf53-mv8mCGA-8rcc-g4xw-pvp6CGA-8wf9-45vm-jqh8CGA-9745-x8gr-c5p9CGA-993p-chj7-3x28CGA-9vpc-fm9j-c524CGA-9x2x-3whr-p9pgCGA-9xh4-gcp6-46v2CGA-c759-h7cr-5cjhCGA-c8v7-7p68-j2q7CGA-crv2-8xg7-3xjqCGA-cx2q-3vwx-j29hCGA-fmgr-mc5w-62jfCGA-frjp-3xmm-wf83CGA-fwcg-94cv-3grqCGA-fx82-7pp7-grw2CGA-g3jq-8hqr-5c3xCGA-gfwc-rvmr-33r2CGA-ghjp-p74j-vxq9CGA-gmm5-r42c-pr84CGA-gmpr-pmww-4jwwCGA-gvjm-g59x-j943CGA-h8f8-p56w-m5p9CGA-hg2g-xg99-vpqcCGA-hmcv-hhff-9g4hCGA-hw7p-cpv4-qwj6CGA-j5j2-2fg9-f68wCGA-jh3c-9hwc-6vh9CGA-jrjx-m48g-fprgCGA-jwc5-m9v7-j489CGA-m22q-c848-v8j9CGA-m3r8-wccq-frw3CGA-mp78-8m24-rf79CGA-mpxq-q682-f6cvCGA-p2x9-7wpm-fffqCGA-pch9-5423-xgc4CGA-pq38-6p2g-m372CGA-pxxv-72v9-4vv6CGA-q8qf-2vmc-p978CGA-q98h-v7r7-53g3CGA-qj49-c2x4-4g76CGA-qqw8-37fg-68jxCGA-qvmr-3w2m-gq4vCGA-r66q-7jxp-x7mpCGA-r74m-fq6w-4g24CGA-r7w9-4pv8-8f5rCGA-r9p6-22qc-xcgvCGA-r9qv-4p5q-5qmhCGA-rhx4-48x3-5wm3CGA-rjcr-c856-fx8xCGA-rvp6-wrvp-57pfCGA-v48q-rrwv-8x8jCGA-v4qw-fq79-6qr7CGA-vh5q-48h7-mcmgCGA-vp53-3637-mp86CGA-vx45-3c3x-2rq9CGA-w9jx-64gh-jvp5CGA-w9xw-q4gw-xw38CGA-wm74-vhfx-qrw2CGA-wvmq-58gm-hp8wCGA-wwvm-p339-hwjcCGA-xmrf-53f6-rrqvCGA-xp2c-wgw9-8c5mCGA-xr85-5x4c-qx3wCGA-44pj-7p4p-8398CGA-w5cj-38fx-62xp
Advisory lineage Upstream: 0 Downstream: 3
Modified
Published: 27 Mar 2026, 20:43
Last modified:04 Sept 2026, 12:04

Vulnerability Summary

Overall Risk (default)
medium
40/100
CVSS Score
7.5 HIGH
v3.1 (cve.org)
EPSS Score
0.6% LOW
1% probability +0.23%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

27 Mar 2026, 20:43
Published
Vulnerability first disclosed
04 Sept 2026, 12:04
Last Modified
Vulnerability information updated

Description

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.

CVSS Metrics

  • v3.1•HIGH•Score: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS Trends

Current EPSS score: 0.60%• Percentile: 47%

Techniques & Countermeasures

  • CWE-835•Loop with Unreachable Exit Condition ('Infinite Loop')

    The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop.

  • CWE-606•Unchecked Input for Loop Condition

    The product does not properly check inputs that are used for loop conditions, potentially leading to a denial of service or other consequences because of excessive looping.

Affected Systems

  • chainguard•arangodb-3.11

    < 3.11.14.4-r10

  • chainguard•arangodb-3.12

    < 3.12.9.4-r4

  • chainguard•gitlab-rails-ce-18.1

    < 18.1.6-r25

  • chainguard•gitlab-rails-ce-18.10

    all

  • chainguard•gitlab-rails-ce-18.11

    < 18.11.6-r7

  • chainguard•gitlab-rails-ce-18.5

    all

  • chainguard•gitlab-rails-ce-18.6

    all

  • chainguard•gitlab-rails-ce-18.7

    all

  • chainguard•gitlab-rails-ce-18.8

    all

  • chainguard•gitlab-rails-ce-18.9

    all

  • chainguard•gitlab-rails-ce-19.0

    < 19.0.5-r1

  • chainguard•gitlab-rails-ce-19.1

    < 19.1.2-r6

  • chainguard•gitlab-rails-ce-fips-18.1

    < 18.1.6-r87

  • chainguard•gitlab-rails-ce-fips-18.10

    all

  • chainguard•gitlab-rails-ce-fips-18.11

    < 18.11.7-r1

  • chainguard•gitlab-rails-ce-fips-18.5

    all

  • chainguard•gitlab-rails-ce-fips-18.6

    all

  • chainguard•gitlab-rails-ce-fips-18.7

    all

  • chainguard•gitlab-rails-ce-fips-18.8

    all

  • chainguard•gitlab-rails-ce-fips-18.9

    all

  • chainguard•gitlab-rails-ce-fips-19.0

    < 19.0.4-r6

  • chainguard•gitlab-rails-ce-fips-19.1

    < 19.1.3-r2

  • chainguard•gitlab-rails-ce-fips-19.2

    < 19.2.1-r5

  • chainguard•katib-earlystopping

    < 0.19.0-r31

  • chainguard•katib-suggestion-goptuna-compat

    all

  • chainguard•katib-suggestion-hyperband

    < 0.19.0-r31

  • chainguard•katib-suggestion-hyperopt

    < 0.19.0-r31 | < 0.19.0-r40

  • chainguard•katib-suggestion-nas-darts

    < 0.19.0-r31

  • chainguard•katib-suggestion-nas-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-optuna-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-pbt-enas

    < 0.19.0-r31

  • chainguard•katib-suggestion-skopt-enas

    < 0.19.0-r31

  • chainguard•katib-tfevent-metricscollector

    < 0.19.0-r31

  • chainguard•kibana-7

    < 7.17.29-r8

  • chainguard•kibana-8.17

    < 8.17.10-r15

  • chainguard•kibana-8.17-bitnami

    < 8.17.10-r15

  • chainguard•kibana-8.17-iamguarded

    < 8.17.10-r15

  • chainguard•kibana-8.18

    < 8.18.8-r11

  • chainguard•kibana-8.18-bitnami

    < 8.18.8-r11

  • chainguard•kibana-8.18-iamguarded

    < 8.18.8-r11

  • chainguard•kibana-8.19

    < 8.19.14-r2

  • chainguard•kibana-8.19-bitnami

    < 8.19.14-r2

  • chainguard•kibana-8.19-iamguarded

    < 8.19.14-r2

  • chainguard•kibana-9.0

    < 9.0.8-r16

  • chainguard•kibana-9.0-bitnami

    < 9.0.8-r16

  • chainguard•kibana-9.0-iamguarded

    < 9.0.8-r16

  • chainguard•kibana-9.1

    < 9.1.10-r12

  • chainguard•kibana-9.1-iamguarded

    < 9.1.10-r12

  • chainguard•kibana-9.2

    < 9.2.7-r5

  • chainguard•kibana-9.2-iamguarded

    < 9.2.7-r5

Showing first 50 affected entries in server-rendered view.

References (13)