Every CVE Search/ Get API key

CVE-2026-2739

bn.js affected by an infinite loop

6.9 MediumFix available

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.53%Up 0.5 points since Feb 20, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.9

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
CVE-2026-2739
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:P
Weakness
CWE-835
Updated
2026-11-02
EUVDEUVD-2026-8025 6.9

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
EUVD-2026-8025
CVSS 4.0
6.9 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Updated
2026-11-02
GitHub AdvisoriesGHSA-378v-28hj-76wf 5.5

bn.js affected by an infinite loop

This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
GHSA-378v-28hj-76wf
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-835
Updated
2026-11-02
NVD 5.5

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
CVE-2026-2739
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-835
Updated
2026-11-02
OSV 5.5

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
CVE-2026-2739
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Weakness
CWE-835
Updated
2026-11-02
OSVDEBIAN-CVE-2026-2739 5.5

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
DEBIAN-CVE-2026-2739
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 14 moreShow less
OSVGHSA-378v-28hj-76wf 5.5

bn.js affected by an infinite loop

This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
GHSA-378v-28hj-76wf
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weakness
CWE-835
Updated
2026-11-02
OSVROOT-APP-NPM-CVE-2026-2739 5.3

CVE-2026-2739 in @rootio/bn.js - Patched by Root

Root has patched CVE-2026-2739 in the @rootio/bn.js package for Root:npm. Multiple fixed versions available.

Record
ROOT-APP-NPM-CVE-2026-2739
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVUBUNTU-CVE-2026-2739 5.5

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
UBUNTU-CVE-2026-2739
CVSS 4.0
5.5 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Updated
2026-11-02
OSVAZL-78290 No score

CVE-2026-2739 affecting package reaper 3.1.1-22

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

Record
AZL-78290
Updated
2026-11-02
OSVCLSA-2026-1779065199 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 4.12.2-tuxcare.1.

Record
CLSA-2026-1779065199
Updated
2026-11-02
OSVCLSA-2026-1779065201 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 5.2.2-tuxcare.1.

Record
CLSA-2026-1779065201
Updated
2026-11-02
OSVCLSA-2026-1782176259 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 4.11.8-tuxcare.1.

Record
CLSA-2026-1782176259
Updated
2026-11-02
OSVCLSA-2026-1782176267 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 4.12.0-tuxcare.2.

Record
CLSA-2026-1782176267
Updated
2026-11-02
OSVCLSA-2026-1789159797 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 4.11.6-tuxcare.1.

Record
CLSA-2026-1789159797
Updated
2026-11-02
OSVCLSA-2026-1790541906 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 4.11.9-tuxcare.1.

Record
CLSA-2026-1790541906
Updated
2026-11-02
OSVCLSA-2026-1791282392 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 5.2.1-tuxcare.1.

Record
CLSA-2026-1791282392
Updated
2026-11-02
OSVCLSA-2026-1792488566 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 5.2.0-tuxcare.1.

Record
CLSA-2026-1792488566
Updated
2026-11-02
OSVCLSA-2026-1792508499 No score

TuxCare security update for bn.js (1 CVE)

TuxCare rebuilt bn.js to address 1 CVE. Fixed in 2.0.4-tuxcare.1.

Record
CLSA-2026-1792508499
Updated
2026-11-02
OSVopenSUSE-SU-2026:11126-1 No score

velociraptor-0.7.0.4.git185.a5708584-2.1 on GA media

These are all security issues fixed in the velociraptor-0.7.0.4.git185.a5708584-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11126-1
Updated
2026-11-02

Affected packages

Affected packages
PackageAffectedFixed
bn.js
npm
 before 4.12.3
4.12.3
bn.js
npm
 5.0.0 up to 5.2.3
5.2.3
reaper
Azure Linux:2
 through 3.1.1-22 None known
bn.js
TuxCare:npm
 4.12.2-tuxcare.0 up to 4.12.2-tuxcare.1, plus listed versions
4.12.2
4.12.2-tuxcare.1
bn.js
TuxCare:npm
 5.2.2-tuxcare.0 up to 5.2.2-tuxcare.1, plus listed versions
5.2.2
5.2.2-tuxcare.1
bn.js
TuxCare:npm
 4.11.8-tuxcare.0 up to 4.11.8-tuxcare.1, plus listed versions
4.11.8
4.11.8-tuxcare.1
bn.js
TuxCare:npm
 4.12.0-tuxcare.0 up to 4.12.0-tuxcare.2, plus listed versions
4.12.04.12.0-tuxcare.1
4.12.0-tuxcare.2
bn.js
TuxCare:npm
 4.11.6-tuxcare.0 up to 4.11.6-tuxcare.1, plus listed versions
4.11.6
4.11.6-tuxcare.1
bn.js
TuxCare:npm
 4.11.9-tuxcare.0 up to 4.11.9-tuxcare.1, plus listed versions
4.11.9
4.11.9-tuxcare.1
bn.js
TuxCare:npm
 5.2.1-tuxcare.0 up to 5.2.1-tuxcare.1, plus listed versions
5.2.1
5.2.1-tuxcare.1
Show 15 moreShow less
Affected packages
PackageAffectedFixed
bn.js
TuxCare:npm
 5.2.0-tuxcare.0 up to 5.2.0-tuxcare.1, plus listed versions
5.2.0
5.2.0-tuxcare.1
bn.js
TuxCare:npm
 2.0.4-tuxcare.0 up to 2.0.4-tuxcare.1, plus listed versions
2.0.4
2.0.4-tuxcare.1
node-bn.js
Debian:12
 All versions, plus listed versions
5.2.1+~5.1.1-15.2.3+~5.2.0-15.2.5+~5.2.0-1
 None known
node-bn.js
Debian:13
 All versions, plus listed versions
5.2.1+~5.1.1-15.2.3+~5.2.0-15.2.5+~5.2.0-1
 None known
node-bn.js
Debian:14
 before 5.2.3+~5.2.0-1, plus listed versions
5.2.1+~5.1.1-1
5.2.3+~5.2.0-1
@rootio/bn.js
Root:npm
 before 4.12.2-root.io.1
4.12.2-root.io.14.11.9-root.io.14.12.2-root.io.24.11.9-root.io.24.12.1-root.io.15.2.1-root.io.1
bn.js
Root:npm
 before 4.12.2-aikido.2
4.12.2-aikido.24.11.9-aikido.24.12.1-aikido.15.2.1-aikido.1
node-bn.js
Ubuntu:18.04:LTS
 All versions, plus listed versions
4.11.8-1
 None known
node-bn.js
Ubuntu:20.04:LTS
 All versions, plus listed versions
5.0.0-15.0.0-25.1.1-15.1.1-2
 None known
node-bn.js
Ubuntu:22.04:LTS
 All versions, plus listed versions
5.1.3-15.2.0-3
 None known
node-bn.js
Ubuntu:24.04:LTS
 All versions, plus listed versions
5.2.1+~5.1.1-1
 None known
node-bn.js
Ubuntu:25.10
 All versions, plus listed versions
5.2.1+~5.1.1-1
 None known
node-bn.js
Ubuntu:26.10
 All versions, plus listed versions
5.2.3+~5.2.0-15.2.5+~5.2.0-1
 None known
node-bn.js
Ubuntu:26.04:LTS
 All versions, plus listed versions
5.2.1+~5.1.1-15.2.3+~5.2.0-1
 None known
velociraptor
openSUSE:Tumbleweed
From an advisory covering 49 CVEs
 before 0.7.0.4.git185.a5708584-2.1
0.7.0.4.git185.a5708584-2.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-2739 is a medium vulnerability (CVSS 6.9) in bn.js, published February 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 45th percentile. Fixed in bn.js 4.12.3.

References

Show 57 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open