Infinite Loop Vulnerability in Node-Forge affecting Digital Bazaar's Implementation

CVE-2026-118781

What is CVE-2026-118781?

The Node-Forge library, primarily used for Transport Layer Security in JavaScript, experienced a significant vulnerability prior to version 1.4.1. This flaw arose from the use of BigInteger.prototype.modInverse() in conjunction with specific inputs, where negative values or moduli could result in an infinite loop. If an attacker had control over the RSA public exponent or the modInverse() operand, they could induce a CPU block in the Node.js event loop. Notably, securely parsed DER, PEM, JWK, PKCS#12, X.509, and TLS values are not affected by this issue. The vulnerability was rectified in version 1.4.1 of Node-Forge.

References