Junglewise Threat Intelligence

CVE-2026-2739: bn.js infinite loop in maskn and toString

CVE-2026-2739 · Severity: low · CVSS 3.1 · Published 2026-02-20

Executive brief

bn.js is a popular JavaScript library for arbitrary-precision arithmetic used in cryptographic and financial applications. A flaw allows attackers to trigger an infinite loop by calling the maskn(0) method, causing applications using this library to hang and become unresponsive. This can result in denial of service for any service or application that processes untrusted input through bn.js operations.

Technical details

The vulnerability is an infinite loop (CWE-835) in the BN.prototype.imaskn() function. When maskn(0) is called, the internal state is corrupted: the this.length field is set to 0, violating bn.js's internal invariant that length must be >= 1. Subsequently, methods like toString() and divmod() contain loops that terminate when isZero() returns true (checking length === 1 && words[0] === 0). With a corrupted length of 0, this condition is never satisfied, causing indefinite loops. The attack is trivial to trigger: `new BN('1', 10).maskn(0).toString()`. The vulnerability requires no authentication or special network access—any code path that accepts user input and passes it to bn.js arithmetic operations is at risk. Patches are available in versions 4.12.3 and 5.2.3, addressing the root cause by ensuring length remains >= 1 after imaskn() operations.

Affected products

  • indutny bn.js before 4.12.3 and before 5.2.3

Timeline

  • 2026-02-20: disclosed: Public disclosure on OSV
  • 2026-02-20: advisory: GHSA-378v-28hj-76wf published
  • 2026-02-19: patched: Fix merged in PR #317; versions 4.12.3 and 5.2.3 released

References