CVE-2026-2739CWE-835

This affects versions of the package bn.js before 5.2.3

Medium · published February 20, 2026

CVSS v4.0
6.9
EPSS
1%
Percentile
51.4
In the wild
Unconfirmed
What it is

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00670 · 51.4th percentile
Weakness
CWE-835 · Loop with Unreachable Exit Condition ('Infinite Loop')
Published
2026-02-20T05:00Z
EPSS history
Timeline
  • 20 FEB 05:00Z
    This affects versions of the package bn.js before 5.2.3
    cvelistv5