PT-2026-20998 · Bn.Js · Bn.Js

Jiahao Li + 1 · Published 2026-02-20 · Updated 2026-05-18 · CVE-2026-2739

Positive Technologies (AI Summary)

CVSS v4.0

5.5

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions bn.js versions prior to 5.2.3

Description The bn.js package is susceptible to a state corruption issue. Calling the maskn(0) function on any BN instance corrupts the internal state. This corruption causes methods like toString(), divmod(), and others to enter an infinite loop, resulting in a process hang.

Recommendations Update bn.js to version 5.2.3 or later.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

AZL-78290

CLEANSTART-2026-LC05413

CVE-2026-2739

GHSA-378V-28HJ-76WF

Affected Products

Bn.Js

References · 157

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-2739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42038 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-NPM-CVE-2026-2739 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-2739 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-378v-28hj-76wf · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41240 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33937 · Security Note
• https://ubuntu.com/security/CVE-2026-2739 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-42041 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-41239 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-4800 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42036 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-15599 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-35213 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-42039 · Security Note