CVE-2026-33891
High
Description
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
SeverityHigh
CVSS7.5
Exploit probability—
ProductDigitalbazaar Forge
PublishedMar 27, 2026
First seenMar 27, 2026
Weakness typeCWE-835CWE-835
How to fix
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| digitalbazaar forge | v ≤ 1.3.3 | — |
| node-forgenpm | v < 1.4.0 | 1.4.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.