{"id":"CVE-2026-118781","kind":"vulnerability","aliases":["CVE-2026-118781"],"related":[],"title":"node-forge: crafted RSA exponent can hang Node.js event loop","description":"Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used BigInteger.prototype.modInverse(), bnModInverse(), lib/jsbn.js, RSA public exponent e to process the relevant input or security decision. node-forge's bundled jsbn implementation entered an infinite loop when BigInteger.prototype.modInverse() received a negative value or modulus. An attacker who could control the RSA public exponent passed to key generation, or a direct modInverse() operand, could block the Node.js event loop at full CPU. Parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are unsigned and cannot trigger this issue. This issue is fixed in version 1.4.1.","summary":"node-forge, a JavaScript TLS and crypto library, could enter an infinite loop in its bundled modInverse routine when given a negative value or modulus. An attacker who controls the RSA public exponent passed to key generation, or a direct modInverse operand, can pin the Node.js process at full CPU and block it.","severity":"low","cvss":2.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","node-forge","node.js","package"],"not_affected_if":["no-user-controlled-rsa-exponent","parse-only-usage"],"how_to_check":"- Check the installed version of `node-forge` in your lockfile, for example with `npm ls node-forge`.\n- Look for code that passes caller-supplied values as RSA public exponents to key generation or calls modInverse directly.","fix":"- `node-forge` `1.4.1`","status":"open","published_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","triaged_at":"2026-10-29T19:27:37+00:00","updated_at":"2026-10-29T19:27:37+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-29T19:27:37Z","model":"claude-haiku-5-5","output":{"fix":"- `node-forge` `1.4.1`","reach":"network","title":"node-forge: crafted RSA exponent can hang Node.js event loop","impact":"low","summary":"node-forge, a JavaScript TLS and crypto library, could enter an infinite loop in its bundled modInverse routine when given a negative value or modulus. An attacker who controls the RSA public exponent passed to key generation, or a direct modInverse operand, can pin the Node.js process at full CPU and block it.","audience":"developers","category":"package","nicknames":[],"who_cares":["node.js","node-forge","javascript"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Node.js event loop blocked at full CPU, causing denial of service","analyst_note":"","how_to_check":"- Check the installed version of `node-forge` in your lockfile, for example with `npm ls node-forge`.\n- Look for code that passes caller-supplied values as RSA public exponents to key generation or calls modInverse directly.","plain_action":"","needs_analyst":false,"not_affected_if":["no-user-controlled-rsa-exponent","parse-only-usage"],"who_is_affected":"Applications that use node-forge in Node.js and pass attacker-influenced RSA public exponents into key generation or direct modInverse operands are exposed. Parsing DER, PEM, JWK, PKCS#12, X.509 or TLS data does not trigger it, so applications that only parse untrusted certificates or keys can likely skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"low"},"cost_usd":0.00071,"input_tokens":4286,"output_tokens":562,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-118781':14A,17A '-2026':13A,16A '1.4.1':95C,184C '12':166C 'affect':97C 'also':78C 'attack':51B,135C 'biginteger.prototype.modinverse':100C,127C 'block':76B,153C 'bnmodinvers':101C 'bundl':40B,119C 'call':79C 'cannot':174C 'control':53B,138C 'could':33B,137C,152C 'cpu':74B,160C 'craft':4A 'crypto':31B 'cve':12A,15A 'decis':114C 'der':162C 'direct':64B,149C 'e':106C 'enter':34B,122C 'event':10A,156C 'expon':6A,57B,105C,142C 'fix':181C 'forg':3A,21B,26B,77C,82C,117C 'full':73B,159C 'generat':61B,146C 'given':44B 'hang':8A 'implement':86C,98C,121C 'infinit':36B,124C 'input':111C 'issu':177C,179C 'javascript':18B,28B,92C 'jsbn':120C 'jwk':164C 'key':60B,145C 'layer':89C 'lib/jsbn.js':102C 'librari':32B 'loop':11A,37B,125C,157C 'modinvers':41B,65B,150C 'modulus':49B,133C 'nativ':85C 'negat':46B,130C 'node':2A,20B,25B,81C,116C 'node-forg':1A,19B,24B,80C,115C 'node.js':9A,22B,70B,155C 'operand':66B,151C 'packag':23B 'pars':161C 'pass':58B,143C 'pem':163C 'pin':68B 'pkcs':165C 'prior':93C 'process':71B,108C 'public':56B,104C,141C 'receiv':128C 'relev':110C 'routin':42B 'rsa':5A,55B,103C,140C 'secur':90C,113C 'tls':29B,169C 'transport':88C 'trigger':175C 'unsign':172C 'use':99C 'valu':47B,131C,170C 'version':183C 'x.509':167C","nicknames":[],"mitigations":[],"who_affected":"Applications that use node-forge in Node.js and pass attacker-influenced RSA public exponents into key generation or direct modInverse operands are exposed. Parsing DER, PEM, JWK, PKCS#12, X.509 or TLS data does not trigger it, so applications that only parse untrusted certificates or keys can likely skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"first_public_at":"2026-10-29T19:17:20+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118781","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118781","severity":null,"published_at":"2026-10-29T19:17:20+00:00","modified_at":"2026-10-29T19:17:20+00:00","first_seen_at":"2026-10-29T19:26:47+00:00","fetched_at":"2026-10-29T19:26:47+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}