Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
1042 articles · 101818 vulns · 38/41 feeds (7d)
← Back to list
5.3
CVE-2026-2739

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, han

Description

This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.

References

  • https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91
  • https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b
  • https://github.com/indutny/bn.js/issues/186
  • https://github.com/indutny/bn.js/issues/316
  • https://github.com/indutny/bn.js/pull/317
  • https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301

Related News (1 articles)

Tier A
Microsoft MSRC1h ago
CVE-2026-2739 This affects versions of the package bn.js before 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
→ No new info (linked only)
CVSS 3.15.3 MEDIUM
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA KEV❌ No
Actively exploited❌ No
CWECWE-835
PublishedFeb 20, 2026
Last enriched14h ago
Trending Score23
Source articles1
Independent1
Info Completeness5/14
Missing: vendor, product, versions, epss, kev, exploit, patch, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Pin to Dashboard

Verification

State: verified
Confidence: 100%

Vulnerability Timeline

CVE Published
Feb 20, 2026
Discovered by ZDM
Apr 1, 2026