CVE-2026-33891

Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.

We have discovered 373 live websites that are affected by CVE-2026-33891.

Run a Free Instant Scan



Affected Software

Product  node-forge
Category JavaScript Libraries
Vulnerable Domains373 live websites (99% of node-forge install base)
Vulnerable Versions
  • from 0 through 1.4
Vulnerable Versions Count5 versions ( 83% of all versions)


Common Weakness Enumeration

CWE-835 Loop with Unreachable Exit Condition ('Infinite Loop')



Details

  • Published - Mar 27, 2026
  • Updated - Sep 4, 2026

Website Distribution by Country

Number of websites using CVE-2026-33891
United States218 websites


China86 websites
Italy33 websites
Australia12 websites
Brazil4 websites
Germany3 websites
Singapore3 websites
Taiwan2 websites
Austria1 websites
Switzerland1 websites

Website Distribution by TLD

Number of websites using CVE-2026-33891
.com194 websites
.cn84 websites
.it37 websites
.com.au18 websites
.org5 websites
.net4 websites
.co2 websites
.at1 websites
.be1 websites
.co.uk1 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-33891

Top websites that are affected by CVE-2026-33891. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
************.com Singapore***,***
*************.com United States***,***
*******.**.*****.cn China***,***
******.******************.com United States***,***
******.*****.cn China*,***,***
******.com United States*,***,***
*******.*****.**.kr Korea, South*,***,***
******.*******.com Mexico*,***,***
*****.com United States*,***,***
****.*****.cn China*,***,***
See full domain list

FAQ

CVE-2026-33891 is Loop with Unreachable Exit Condition ('Infinite Loop') in node-forge
A total of 373 websites have been identified as vulnerable to CVE-2026-33891, based on global website indexing conducted by WebTechSurvey.
The node-forge is affected by the CVE-2026-33891 vulnerability.
node-forge versions up to 1.4 are vulnerable to CVE-2026-33891.
CVE-2026-33891 is resolved in version 1.4 of node-forge.