Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-33891 Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability… https://www.cve.org/CVERecord?id=CVE-2026-33891
Post summary
The text announces a DoS vulnerability in node-forge before version 1.4.0, referencing CVE-2026-33891, without providing PoC, exploit code, or evidence of active exploitation.
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-33891 - Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input Intel Report: https://ift.tt/UFmEps7
Post summary
The alert announces CVE-2026-33891, detailing a Denial of Service vulnerability in Forge's BigInteger.modInverse() triggered by a zero input.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | digitalbazaar | forge | - | node.js | - |