Medium
Security advisory
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-2739
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 01:18 UTC · Revision 1
Source evidence
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
osv:CVE-2026-2739
Complete source record
{
"id": "18355bfc9dc3daac07297df75ee1d8e0b3690d89f11cd9e4ea51967ef64ab1bd",
"url": "https://osv.dev/vulnerability/CVE-2026-2739",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2026-2739",
"summary": "This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.",
"evidence": "osv:CVE-2026-2739",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2026-2739",
"aliases": [
"CVE-2026-2739",
"GHSA-378v-28hj-76wf"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/indutny/bn.js",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "ea6c072a951493ca99e5cd5f8da3851b90116271"
},
{
"fixed": "33df26b5771e824f303a79ec6407409376baa64b"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "0"
},
{
"fixed": "5.2.3"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
},
{
"range": [
{
"fixed": "33df26b5771e824f303a79ec6407409376baa64b"
}
],
"source": "REFERENCES_COMMIT"
}
]
}
}
],
"versions": [
"v5.2.2",
"v5.2.1",
"v5.2.0",
"v5.1.3",
"v5.1.2",
"v4.11.8",
"v5.1.1",
"v5.1.0",
"v5.0.0",
"v4.11.7",
"v4.11.6",
"v4.11.5",
"v4.11.4",
"v4.11.3",
"v4.11.2",
"v4.11.1",
"v4.11.0",
"v4.10.5",
"v4.10.4",
"v4.10.3",
"v4.10.2",
"v4.10.1",
"v4.10.0",
"v4.9.0",
"v4.8.1",
"v4.8.0",
"v4.7.0",
"v4.6.6",
"v4.6.5",
"v4.6.4",
"v4.6.3",
"v4.6.2",
"v4.6.1",
"v4.6.0",
"v4.5.2",
"v4.5.1",
"v4.5.0",
"v4.4.0",
"v4.3.0",
"v4.2.0",
"v4.1.1",
"v4.1.0",
"v4.0.0",
"v3.3.0",
"v3.2.0",
"v3.1.2",
"v3.1.1",
"v3.1.0",
"v3.0.1",
"v3.0.0",
"v2.2.0",
"v2.1.0",
"v2.0.5",
"v2.0.4",
"v2.0.3",
"v2.0.2",
"v2.0.1",
"v2.0.0",
"v1.3.0",
"v1.2.4",
"v1.2.3",
"v1.2.2",
"v1.2.1",
"v1.2.0",
"v1.1.1",
"v1.1.0",
"v1.0.1",
"v1.0.0",
"v0.16.1",
"v0.16.0",
"v0.15.2",
"v0.15.1",
"v0.15.0",
"v0.14.2",
"v0.14.1",
"v0.14.0",
"v0.13.3",
"v0.13.2",
"v0.13.1",
"v0.13.0",
"v0.12.0",
"v0.11.7",
"v0.11.6",
"v0.11.5",
"v0.11.4",
"v0.11.3",
"v0.11.2",
"v0.11.1",
"v0.11.0",
"v0.10.1",
"v0.10.0",
"v0.9.0",
"v0.8.1",
"v0.8.0",
"v0.7.1",
"v0.7.0",
"v0.6.0",
"v0.5.4",
"v0.5.3",
"v0.5.2",
"v0.5.1",
"v0.5.0",
"v0.4.4",
"v0.4.3",
"v0.4.2",
"v0.4.1",
"v0.4.0",
"v0.3.1",
"v0.3.0",
"v0.2.2",
"v0.2.1",
"v0.2.0",
"v0.1.7",
"v0.1.6",
"v0.1.5",
"v0.1.4",
"v0.1.3",
"v0.1.2",
"v0.1.1",
"v0.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-2739.json"
}
}
],
"modified": "2026-10-28T02:30:41.393472046Z",
"provider": "osv",
"references": [
"https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91",
"https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2739.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-2739",
"https://github.com/indutny/bn.js/issues/186",
"https://github.com/indutny/bn.js/issues/316",
"https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b",
"https://github.com/indutny/bn.js/pull/317"
],
"provider_metadata": {
"cwe_ids": [
"CWE-835"
],
"cna_assigner": "snyk",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/2xxx/CVE-2026-2739.json"
}
},
"related_cves": [
{
"value": "CVE-2026-2739",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508983,
"published_at": "2026-02-20T05:00:08.253+00:00"
}