CVE-2026-2739

MEDIUM

bn.js <5.2.3 - DoS

Title source: llm
STIX 2.1

Description

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

References (6)

Core 6

Scores

CVSS v3 5.3
EPSS 0.0047
EPSS Percentile 36.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-835
Status published
Products (2)
n/a/bn.js < 5.2.3
npm/bn.js 0 - 5.2.3npm
Published Feb 20, 2026
Tracked Since Feb 20, 2026