{"id":"CVE-2026-118781","aliases":["GHSA-h6cr-wjv9-3cpp"],"url":"https://o3.security/vulnerability/CVE-2026-118781","summary":"Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)","details":"### Summary\n\n`BigInteger.prototype.modInverse()` in node-forge's bundled jsbn library enters an infinite loop when the value or the modulus is negative, for example when a negative public exponent is passed to `forge.pki.rsa.generateKeyPair()`. This is an incomplete fix of CVE-2026-33891 (GHSA-5m6q-g25r-mvwx), which handled only a zero value. Fixed in node-forge 1.4.1.\n\n### Details\n\n`bnModInverse()` (`lib/jsbn.js`, exposed as `forge.jsbn.BigInteger.prototype.modInverse`) implements the binary extended Euclidean algorithm (Handbook of Applied Cryptography, Algorithm 14.61), which is defined for positive integers. With a negative operand the loop cannot terminate: `rShiftTo` is an arithmetic shift, so a negative value never moves towards zero, and the loop's exit condition (`u` reaching zero) is never met. The calling thread spins at 100% CPU indefinitely; in Node.js this blocks the event loop. Memory does not grow.\n\nnode-forge 1.4.0 fixed CVE-2026-33891 (GHSA-5m6q-g25r-mvwx) by returning zero early when `this.signum() == 0`, although its changelog describes the check as \"<= 0\". Negative values were not covered, and a negative modulus was never handled. Every negative input that did terminate already returned zero.\n\nWithin node-forge, RSA key generation is the only path to a negative operand: the caller's public exponent `e` becomes `BigInteger.fromInt(e)`, and `state.e.modInverse(state.phi)` is called with it. `gcd()` works on absolute values, so the coprimality checks pass and the loop is reached. Any exponent other than 3 or 65537 uses the pure JavaScript implementation, even when `forge.options.usePureJavaScript` is not set. RFC 8017, Section 3.1 requires the RSA public exponent to be at least 3.\n\nValues that node-forge parses (DER, PEM, JWK, PKCS#12, X.509, TLS) are always read as unsigned integers and cannot produce a negative operand.\n\nThe fix makes `modInverse()` return zero when the value or the modulus is zero or negative, as it already does when no inverse exists. Results for positive inputs are unchanged.\n\nThis issue was reported by wzc.\n\n### Patches\nFixed in node-forge 1.4.1. `modInverse()` now returns zero when the value or the modulus is zero or negative.\n\n### Workarounds\n- Pass only fixed, valid RSA public exponents (e.g. 65537) to key generation, or validate caller-supplied exponents first: an odd integer `>= 3`.\n- Do not call `BigInteger#modInverse()` with negative operands. Reduce the value modulo a positive modulus first (`x.mod(m).modInverse(m)`).\n\n### Proof of concept\n\nA negative public exponent passed to RSA key generation never returns (also with the callback form and with `createKeyPairGenerationState()` / `stepKeyPairGenerationState()`):\n\n    var forge = require('node-forge');\n    forge.pki.rsa.generateKeyPair({bits: 256, e: -1});  // hangs at 100% CPU\n\nCalling `modInverse()` directly with a negative value or modulus hangs the same way:\n\n    var BigInteger = forge.jsbn.BigInteger;\n    new BigInteger('-1').modInverse(new BigInteger('7'));  // hangs\n    new BigInteger('3').modInverse(new BigInteger('-7'));  // hangs\n\nWith the fix, these calls return zero. The regression tests are in `tests/unit/jsbn.js`.\n\n### Impact\n\nApplications are affected only if they:\n- pass an untrusted value as the RSA public exponent `e` to `forge.pki.rsa.generateKeyPair()`, `forge.pki.rsa.createKeyPairGenerationState()` or `forge.pki.rsa.stepKeyPairGenerationState()`, or\n- call `forge.jsbn.BigInteger#modInverse()` directly with negative values derived from untrusted input.\n\nAn attacker who can supply such a value makes the call hang indefinitely at 100% CPU, which blocks the Node.js event loop (denial of service). Keys and other data parsed by node-forge (DER, PEM, JWK, PKCS#12, X.509, TLS) cannot trigger this issue, and the documented usage of key generation passes a constant exponent (65537). There is no effect on confidentiality or integrity.","published":"2026-10-29T18:49:28.661Z","modified":"2026-10-31T02:47:36.861021139Z","cvss":{"score":2.9,"severity":"LOW","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"npm","name":"node-forge","fixedVersion":"1.4.1"}],"fix":{"url":"https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72","label":"digitalbazaar/forge@e96c47b"},"references":[{"type":"WEB","url":"https://github.com/digitalbazaar/forge/releases/tag/v1.4.1"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118781.json"},{"type":"ADVISORY","url":"https://github.com/digitalbazaar/forge/security/advisories/GHSA-h6cr-wjv9-3cpp"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118781"},{"type":"FIX","url":"https://github.com/digitalbazaar/forge/commit/e96c47b7f006dec66fb7bb1934e7375498b04a72"},{"type":"PACKAGE","url":"https://github.com/digitalbazaar/forge"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-31T02:47:36.861021139Z"}}