Medium
node-bn.js — security advisory
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
- Products
- node-bn.js
- Affected versions
- 4.11.8-1, 5.0.0-1, 5.0.0-2, 5.1.1-1, 5.1.1-2, 5.1.3-1, 5.2.0-3, 5.2.1+~5.1.1-1, 5.2.3+~5.2.0-1, 5.2.5+~5.2.0-1
- Fixed versions
- Not specified
- CVEs
- CVE-2026-2739
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 31 Oct 2026, 02:06 UTC · Revision 1
Source evidence
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
osv:UBUNTU-CVE-2026-2739
node-bn.js
Fixed versions: Not specified
node-bn.js
Fixed versions: Not specified
node-bn.js
Fixed versions: Not specified
node-bn.js
Fixed versions: Not specified
node-bn.js
Fixed versions: Not specified
node-bn.js
Fixed versions: Not specified
node-bn.js
Fixed versions: Not specified
Complete source record
{
"id": "4f5d0356654e806c069d2f8da42c416d44aba9f89568ae3c6372a5a1c161a1f1",
"url": "https://osv.dev/vulnerability/UBUNTU-CVE-2026-2739",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "UBUNTU-CVE-2026-2739",
"summary": "This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.",
"evidence": "osv:UBUNTU-CVE-2026-2739",
"products": [
{
"name": {
"value": "node-bn.js",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "4.11.8-1",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "node-bn.js",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.0.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.0.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "5.1.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "5.1.1-2",
"evidence": "/affected/1/versions"
}
]
},
{
"name": {
"value": "node-bn.js",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.1.3-1",
"evidence": "/affected/2/versions"
},
{
"value": "5.2.0-3",
"evidence": "/affected/2/versions"
}
]
},
{
"name": {
"value": "node-bn.js",
"evidence": "/affected/3/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.2.1+~5.1.1-1",
"evidence": "/affected/3/versions"
}
]
},
{
"name": {
"value": "node-bn.js",
"evidence": "/affected/4/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.2.1+~5.1.1-1",
"evidence": "/affected/4/versions"
}
]
},
{
"name": {
"value": "node-bn.js",
"evidence": "/affected/5/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.2.3+~5.2.0-1",
"evidence": "/affected/5/versions"
},
{
"value": "5.2.5+~5.2.0-1",
"evidence": "/affected/5/versions"
}
]
},
{
"name": {
"value": "node-bn.js",
"evidence": "/affected/6/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "5.2.1+~5.1.1-1",
"evidence": "/affected/6/versions"
},
{
"value": "5.2.3+~5.2.0-1",
"evidence": "/affected/6/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "UBUNTU-CVE-2026-2739",
"aliases": [
"UBUNTU-CVE-2026-2739"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
},
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P"
},
{
"type": "Ubuntu",
"score": "medium"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-bn.js",
"purl": "pkg:deb/ubuntu/node-bn.js?arch=source&distro=bionic",
"ecosystem": "Ubuntu:18.04:LTS"
},
"versions": [
"4.11.8-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2739.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-bn.js",
"binary_version": "4.11.8-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-bn.js",
"purl": "pkg:deb/ubuntu/node-bn.js?arch=source&distro=focal",
"ecosystem": "Ubuntu:20.04:LTS"
},
"versions": [
"5.0.0-1",
"5.0.0-2",
"5.1.1-1",
"5.1.1-2"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2739.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-bn.js",
"binary_version": "5.1.1-2"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-bn.js",
"purl": "pkg:deb/ubuntu/node-bn.js?arch=source&distro=jammy",
"ecosystem": "Ubuntu:22.04:LTS"
},
"versions": [
"5.1.3-1",
"5.2.0-3"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2739.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-bn.js",
"binary_version": "5.2.0-3"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-bn.js",
"purl": "pkg:deb/ubuntu/node-bn.js?arch=source&distro=noble",
"ecosystem": "Ubuntu:24.04:LTS"
},
"versions": [
"5.2.1+~5.1.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2739.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-bn.js",
"binary_version": "5.2.1+~5.1.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-bn.js",
"purl": "pkg:deb/ubuntu/node-bn.js?arch=source&distro=questing",
"ecosystem": "Ubuntu:25.10"
},
"versions": [
"5.2.1+~5.1.1-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2739.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-bn.js",
"binary_version": "5.2.1+~5.1.1-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-bn.js",
"purl": "pkg:deb/ubuntu/node-bn.js?arch=source&distro=stonking",
"ecosystem": "Ubuntu:26.10"
},
"versions": [
"5.2.3+~5.2.0-1",
"5.2.5+~5.2.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2739.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-bn.js",
"binary_version": "5.2.5+~5.2.0-1"
}
]
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "node-bn.js",
"purl": "pkg:deb/ubuntu/node-bn.js?arch=source&distro=resolute",
"ecosystem": "Ubuntu:26.04:LTS"
},
"versions": [
"5.2.1+~5.1.1-1",
"5.2.3+~5.2.0-1"
],
"database_specific": {
"source": "https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2026/UBUNTU-CVE-2026-2739.json"
},
"ecosystem_specific": {
"binaries": [
{
"binary_name": "node-bn.js",
"binary_version": "5.2.3+~5.2.0-1"
}
]
}
}
],
"modified": "2026-10-17T12:58:07.628609097Z",
"provider": "osv",
"upstream": [
"CVE-2026-2739"
],
"references": [
"https://ubuntu.com/security/CVE-2026-2739",
"https://www.cve.org/CVERecord?id=CVE-2026-2739",
"https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301",
"https://github.com/indutny/bn.js/issues/316",
"https://github.com/indutny/bn.js/issues/186",
"https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91",
"https://github.com/indutny/bn.js/pull/317",
"https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b"
]
},
"related_cves": [
{
"value": "CVE-2026-2739",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/1/score"
},
"source_id": "core-osv",
"document_id": 358175,
"published_at": "2026-02-20T05:17:00+00:00"
}