CVE-2026-2739
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod()...
Original description
The description as published by the source.
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-2739 node-bn.js
- Ubuntu UBUNTU-CVE-2026-2739 node-bn.js
References
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- report github.com
- report github.com
- web gist.github.com
- web security.snyk.io