CVE-2026-33891: Node-Forge BigInteger DoS Vulnerability

CVE-2026-33891 Overview

A Denial of Service (DoS) vulnerability has been identified in Forge (also called node-forge), a native implementation of Transport Layer Security (TLS) in JavaScript. The vulnerability exists due to an infinite loop in the BigInteger.modInverse() function, which is inherited from the bundled jsbn library. When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU resources.

Critical Impact

Applications using node-forge for cryptographic operations can be rendered completely unresponsive through a simple malicious input, potentially affecting all users of the affected service.

Affected Products

• node-forge versions prior to 1.4.0
• Applications and services utilizing vulnerable node-forge library for TLS/cryptographic operations
• JavaScript/Node.js projects with node-forge as a dependency

Discovery Timeline

• 2026-03-27 - CVE-2026-33891 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2026-33891

Vulnerability Analysis

This vulnerability stems from improper input validation in the BigInteger.modInverse() function within the node-forge library. The function implements the Extended Euclidean Algorithm to compute modular multiplicative inverses, a common operation in cryptographic computations such as RSA key generation and digital signatures.

When a zero value is passed as the modulus parameter, the algorithm fails to terminate because its exit condition becomes mathematically unreachable. This causes the function to execute indefinitely in an infinite loop. The practical impact is severe: a single malicious request can cause a Node.js process to consume 100% CPU and become completely unresponsive to legitimate requests.

The vulnerability is classified under CWE-835 (Loop with Unreachable Exit Condition), commonly known as an infinite loop vulnerability. This type of flaw is particularly dangerous in server-side JavaScript applications where a single-threaded event loop handles all requests—blocking this loop effectively creates a complete denial of service.

Root Cause

The root cause lies in the inherited jsbn library code bundled within node-forge. The BigInteger.modInverse() function lacks proper validation for edge cases, specifically when zero is provided as an input parameter. In modular arithmetic, the modular inverse of any number modulo zero is mathematically undefined, and the function should reject this input with an appropriate error. Instead, the algorithm proceeds with its iterative computation, entering a state where the termination condition can never be satisfied.

Attack Vector

An attacker can exploit this vulnerability remotely over the network by providing specially crafted input to any application endpoint that processes data through node-forge's cryptographic functions. The attack requires no authentication or special privileges—simply passing a zero value to trigger the vulnerable code path. Since many applications use node-forge for certificate validation, TLS handshakes, or other cryptographic operations, the attack surface can be substantial.

The exploitation is straightforward: identify an input path that reaches the BigInteger.modInverse() function and supply a zero value. This could be through malformed certificates, crafted key parameters, or other cryptographic inputs that eventually trigger the vulnerable function.

Detection Methods for CVE-2026-33891

Indicators of Compromise

• Node.js processes showing sustained 100% CPU utilization without corresponding legitimate workload
• Application servers becoming unresponsive or timing out on all requests
• Monitoring alerts indicating event loop blocking or high event loop lag in Node.js applications
• Log entries showing cryptographic operations that never complete

Detection Strategies

• Implement Software Composition Analysis (SCA) to identify node-forge versions prior to 1.4.0 in your dependency tree
• Monitor CPU utilization patterns and alert on anomalous sustained high usage
• Use application performance monitoring (APM) tools to detect event loop blocking in Node.js applications
• Review package-lock.json or yarn.lock files for vulnerable node-forge versions in both direct and transitive dependencies

Monitoring Recommendations

• Configure alerts for Node.js process CPU utilization exceeding thresholds for extended periods
• Implement health check endpoints with timeout monitoring to detect unresponsive services
• Enable event loop lag monitoring and set appropriate alerting thresholds
• Monitor for patterns of incomplete cryptographic operations in application logs

How to Mitigate CVE-2026-33891

Immediate Actions Required

• Upgrade node-forge to version 1.4.0 or later immediately
• Audit your application's dependency tree using npm audit or yarn audit to identify all instances of vulnerable node-forge versions
• Review and update transitive dependencies that may include vulnerable node-forge versions
• Consider implementing input validation at application boundaries before data reaches cryptographic functions

Patch Information

The vulnerability has been patched in node-forge version 1.4.0. The fix adds proper input validation to the BigInteger.modInverse() function to prevent zero values from triggering the infinite loop condition. The specific patch can be reviewed in the GitHub commit. For detailed information about the vulnerability, refer to the GitHub Security Advisory GHSA-5m6q-g25r-mvwx.

Workarounds

• If immediate upgrade is not possible, implement application-level input validation to reject zero values before they reach node-forge functions
• Deploy request timeout mechanisms to terminate long-running operations that may indicate exploitation attempts
• Implement process monitoring with automatic restart capabilities to recover from DoS conditions
• Consider using a web application firewall (WAF) to filter malformed cryptographic inputs

# Upgrade node-forge to patched version
npm update node-forge@^1.4.0

# Verify installed version
npm list node-forge

# Run security audit to check for vulnerable dependencies
npm audit