Bug 2452450 (CVE-2026-33891)

Summary:	CVE-2026-33891 node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse()
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aazores, abrianik, bdettelb, caswilli, cmah, dhanak, doconnor, drosa, dschmidt, eaguilar, ebaron, erezende, ewittman, ggrzybek, gmalinko, ibek, janstey, jcantril, jlanda, jolong, jrokos, jwong, kaycoth, kshier, lchilton, mnovotny, nipatil, omaciel, pantinor, parichar, pdelbell, pjindal, rkubis, rojacob, rstepani, sausingh, sfeifer, simaishi, smcdonal, stcannon, tasato, teagle, ttakamiy, yguenane
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the node-forge library, a JavaScript implementation of Transport Layer Security. This vulnerability, inherited from the bundled jsbn library, allows a remote attacker to cause a Denial of Service (DoS). When the BigInteger.modInverse() function is called with a zero value, it enters an infinite loop, causing the process to hang indefinitely and consume 100% of the CPU resources.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2452503, 2452504, 2452499, 2452500, 2452501, 2452502
Bug Blocks:

Description OSIDB Bzimport 2026-03-27 21:01:58 UTC

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.

Comment 2 errata-xmlrpc 2026-06-09 11:01:37 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.6 for RHEL 9
  Red Hat Ansible Automation Platform 2.6 for RHEL 10

Via RHSA-2026:24762 https://access.redhat.com/errata/RHSA-2026:24762

Comment 3 errata-xmlrpc 2026-06-09 11:03:21 UTC

This issue has been addressed in the following products:

  Red Hat Ansible Automation Platform 2.5 for RHEL 9
  Red Hat Ansible Automation Platform 2.5 for RHEL 8

Via RHSA-2026:24761 https://access.redhat.com/errata/RHSA-2026:24761