CVE-2026-33891: 
JavaScript vulnerability analysis and mitigation

CVE-2026-33891 is a Denial of Service vulnerability in the node-forge cryptographic library (npm package) caused by an infinite loop in the BigInteger.modInverse() function. All versions up to and including 1.3.3 are affected; version 1.4.0 patches the issue. The vulnerability was disclosed on March 24, 2026, by researcher Kr0emer via the GitHub Security Advisory GHSA-5m6q-g25r-mvwx, and was published to the NVD on March 27, 2026. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is an unchecked input condition (CWE-835: Loop with Unreachable Exit Condition; CWE-606: Unchecked Input for Loop Condition) in the bnModInverse() function within lib/jsbn.js, which is a bundled copy of the jsbn (JavaScript Big Number) library. When modInverse() is called with a zero value, the Extended Euclidean Algorithm's loop termination condition can never be satisfied — mathematically, the modular inverse of 0 does not exist — causing the Node.js process to spin at 100% CPU indefinitely. The fix, applied in commit 9bb8d67, adds a single guard: if(this.signum() == 0) return BigInteger.ZERO; at the entry of bnModInverse(). Exploitable attack surfaces include DSA/ECDSA signature verification (crafted s = 0), custom RSA or Diffie-Hellman implementations, and any cryptographic protocol where an attacker can supply a value that reaches modInverse() (GitHub Advisory, Patch Commit).

Successful exploitation causes a complete Denial of Service: the Node.js event loop blocks indefinitely, consuming 100% CPU and rendering the entire application unresponsive to all subsequent requests until the process is manually restarted. There is no confidentiality or integrity impact — the vulnerability is purely an availability issue. Given that node-forge has millions of weekly npm downloads, the blast radius is broad, affecting any application that processes untrusted cryptographic parameters through the library, including enterprise products such as IBM Maximo Application Suite, IBM API Connect, IBM App Connect Enterprise, IBM Sterling Connect:Direct Web Services, and Red Hat Ansible Automation Platform (GitHub Advisory, Red Hat Bugzilla).

A public proof-of-concept (PoC) script (poc.js) is available in the official GitHub Security Advisory; it demonstrates the infinite loop by spawning a child process with a 5-second timeout and confirming the DoS condition (GitHub Advisory). No weaponized exploit kits or in-the-wild exploitation have been reported as of the time of writing. The EPSS score is approximately 0.04–0.08% (low probability of exploitation in the next 30 days), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No specific threat actor attribution has been made.

1. Identify a vulnerable target: Locate a Node.js application that uses node-forge version ≤ 1.3.3 and exposes an endpoint that processes attacker-controlled cryptographic input (e.g., DSA/ECDSA signature verification, RSA key exchange, or custom modular arithmetic).
2. Craft a malicious input: Construct a cryptographic parameter where the value that will be passed to modInverse() is zero — for example, a DSA signature with s = 0, or a crafted RSA/DH parameter set where the relevant BigInteger value is zero.
3. Send the crafted request: Submit the malicious input to the target application's endpoint (e.g., an API accepting a signed payload or a TLS handshake parameter).
4. Trigger the infinite loop: The application passes the zero value to BigInteger.modInverse(), which enters the Extended Euclidean Algorithm loop with an unreachable exit condition, causing the Node.js process to spin at 100% CPU indefinitely.
5. Achieve DoS: The Node.js event loop is blocked; the application becomes unresponsive to all subsequent requests. A single request is sufficient to take down the service until it is manually restarted (GitHub Advisory).

• Process: Node.js process consuming 100% CPU continuously with no corresponding increase in legitimate traffic; process remains alive but unresponsive (no new requests handled).
• Logs: Application logs showing the last processed request involved a cryptographic operation (e.g., signature verification, key exchange) followed by a complete cessation of log output; no crash or error logged (the process hangs, not crashes).
• Network: A single inbound request to a cryptographic endpoint (e.g., signature verification API) immediately preceding the service becoming unresponsive; the connection may remain open or time out on the client side.
• System Metrics: Sudden spike to 100% CPU utilization on the Node.js process sustained indefinitely; no memory growth (the loop does not allocate), distinguishing it from memory-exhaustion DoS attacks.

The primary remediation is to upgrade node-forge to version 1.4.0 or later, which adds a zero-value guard in bnModInverse() (Patch Commit, GitHub Advisory). As a short-term workaround where upgrading is not immediately possible, implement input validation to reject zero-value cryptographic parameters before they reach modInverse(), and configure process supervisors (e.g., PM2, systemd) with automatic restart on hang detection. Red Hat has addressed the issue in Red Hat Ansible Automation Platform 2.5 and 2.6 via RHSA-2026:24761 and RHSA-2026:24762 respectively (Red Hat Bugzilla). IBM has released patches for affected products including Data Product Hub, Watsonx BI Assistant, Maximo Application Suite, App Connect Enterprise, API Connect, and Sterling Connect:Direct Web Services.

The vulnerability was reported by researcher Kr0emer and published by maintainer davidlehn on March 24, 2026. Red Hat rated the issue as High severity and tracked it via Bugzilla with 44 CC'd users, indicating broad internal concern across product teams (Red Hat Bugzilla). IBM issued multiple security bulletins across its product portfolio, reflecting the wide downstream impact of the node-forge dependency. Social media activity was noted on Mastodon and Bluesky, though no major independent security researcher commentary or media coverage beyond standard vulnerability tracking was identified.