CVE-2026-2739: Medium severity npm/bn.js vulnerability
This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
Other sources
This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
npm/bn.jsto a version that resolves this vulnerability.Fixed in 5.2.3 - Upgrade
Upgrade
npm/bn.jsto a version that resolves this vulnerability.Fixed in 4.12.3 - Upgrade
Upgrade
bn.jsto a version that resolves this vulnerability.Fixed in 4.12.3 - Upgrade
Upgrade
bn.jsto a version that resolves this vulnerability.Fixed in 5.2.3
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2739?
CVE-2026-2739 is classified as a critical vulnerability due to its potential to cause application hang and impact system performance.
How do I fix CVE-2026-2739?
To mitigate CVE-2026-2739, upgrade your bn.js package to version 5.2.3 or later.
What versions are affected by CVE-2026-2739?
CVE-2026-2739 affects all versions of the bn.js package prior to 5.2.3.
What happens if I call maskn(0) on a BN instance in CVE-2026-2739?
Calling maskn(0) on a BN instance can corrupt its internal state, leading to infinite loops in various methods like toString() and divmod().
Can CVE-2026-2739 affect production environments?
Yes, CVE-2026-2739 can significantly affect production environments by causing processes to hang indefinitely.