CVE-2026-2739: 
JavaScript vulnerability analysis and mitigation

CVE-2026-2739 is a Denial of Service vulnerability in the bn.js npm package caused by an infinite loop triggered by calling maskn(0) on any BN instance. The flaw affects bn.js versions before 4.12.3 and versions 5.0.0 through 5.2.2; patched versions are 4.12.3 and 5.2.3. It was discovered on February 8, 2026 via fuzz testing and publicly disclosed on February 20, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) and a CVSS v4.0 base score of 5.5 (Medium) (GitHub Advisory).

The root cause is classified as CWE-835 (Loop with Unreachable Exit Condition). In BN.prototype.imaskn, when bits = 0, the computation s = (bits - r) / 26 yields s = 0, causing this.length to be set to Math.min(0, this.length) = 0. This violates bn.js's internal invariant that this.length >= 1; the subsequent _strip() call does not correct a length of 0. Any method that loops until isZero() returns true (which checks this.length === 1 && this.words[0] === 0) will loop forever because the condition is never satisfied with length = 0, consuming 100% CPU on the affected thread. A public proof-of-concept demonstrating the hang via new BN('1', 10).maskn(0) followed by toString() was published by the discoverer (PoC Gist, GitHub Advisory).

Successful exploitation causes the affected Node.js process to hang indefinitely, resulting in a complete denial of service for any application relying on bn.js for cryptographic operations. Because bn.js has over 5,670 npm dependents — including widely used libraries such as elliptic, browserify-sign, and create-ecdh — the blast radius extends to blockchain/Web3 applications, TLS/SSL implementations, and any service where an attacker can influence the bits parameter passed to maskn(). There is no confidentiality or integrity impact; the sole consequence is availability loss (PoC Gist, GitHub Advisory).

A public proof-of-concept has been available since February 8, 2026, when the vulnerability was discovered through fuzz testing and submitted to Snyk's disclosure program. No evidence of in-the-wild exploitation or threat actor attribution has been reported. The EPSS score is approximately 0.015–0.022% (7th percentile), indicating low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The CVSS v4.0 exploit maturity is rated "Proof of Concept" (GitHub Advisory).

1. Identify vulnerable applications: Locate network-accessible services that use bn.js versions before 4.12.3 or 5.0.0–5.2.2 and expose an interface where user-supplied input influences cryptographic parameters (e.g., key lengths, bit widths, or values passed to maskn()).
2. Craft malicious input: Prepare a request or payload that causes the application to call maskn(0) on a BN instance — for example, by supplying a bit-length value of 0 to a cryptographic operation that internally invokes maskn.
3. Trigger the corrupted state: The call new BN(value).maskn(0) sets this.length = 0, corrupting the internal state of the BN object (x.isZero() returns false despite the corrupted length).
4. Induce the infinite loop: Any subsequent operation on the corrupted BN object that calls toString(), divmod(), or similar methods will enter an infinite loop, consuming 100% CPU and hanging the process indefinitely.
5. Achieve DoS: The target service becomes unresponsive, requiring a manual restart to recover (PoC Gist).

• Process Behavior: Node.js process consuming 100% CPU on a single thread with no progress; process becomes unresponsive to new requests.
• Logs: Application logs showing requests that initiated cryptographic operations but never completed; absence of response log entries for specific requests that triggered the hang.
• Network: Connections to the service that remain open indefinitely without receiving a response, potentially causing upstream timeouts or connection pool exhaustion.
• Application Monitoring: Alerts from APM tools indicating a specific endpoint or function has exceeded maximum execution time thresholds with no return.

Upgrade bn.js to version 4.12.3 (for the 4.x branch) or 5.2.3 (for the 5.x branch), which includes the fix that adds a guard restoring this.length = 1 and this.words[0] = 0 when length reaches 0 after imaskn (bn.js fix commit, GitHub Advisory). As a short-term workaround where upgrading is not immediately possible, validate and reject any user-supplied bits parameter equal to 0 before it reaches maskn(). IBM has also released patches for affected products including API Connect, QRadar Suite Software, watsonx Orchestrate, Cloud Pak for Business Automation, and Business Automation Insights (IBM API Connect, IBM QRadar).

The vulnerability was discovered by researcher Kr0emer through fuzz testing of cryptographic JavaScript libraries and responsibly disclosed to Snyk on February 8, 2026. The GitHub Advisory was reviewed and published on February 20, 2026. Multiple downstream vendors including IBM and Microsoft acknowledged the vulnerability and issued security bulletins for their affected products. The issue highlights a longstanding class of bn.js internal-state bugs, as a related infinite loop from new BN(null).toString() was reported as early as June 2018 (Issue #186) but remained unaddressed until this disclosure prompted the fix (GitHub Issue #186, GitHub Advisory).