CVE Watch15 jul 2026

CVE-2026-33891

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of S

CVSS

7.5

Alto

EPSS

0.6%

p45

KEV

—

Exploit Today

0-100

Publicado: 27 mar 2026 · Última mod.: 15 jul 2026 · CWE-835 · CWE-606

EPSS · 30d

0.6%EPSS · 30 días0.6%

2026-06-302026-07-16

Descripción técnica

Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.

Referencias oficiales

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-48907.5 ALT

93.6%

——28A Denial of Service (DoS) vulnerability in the DNSSEC validation of dnsmasq allows remote attackers to cause a denial of service via a crafted DNS packet.2d CVE-2026-428997.5 ALT

82.4%

——25Loop with unreachable exit condition ('infinite loop') in ASP.NET Core allows an unauthorized attacker to deny service over a network.2d CVE-2026-331167.5 ALT

80.0%

——24Loop with unreachable exit condition ('infinite loop') in .NET, .NET Framework, Visual Studio allows an unauthorized attacker to deny service over a network.2d CVE-2026-465227.5 ALT

76.7%

——23ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to versions 7.1.2.23 and 6.9.13-48, due to a missing check in the MIFF decoder, a crafted file could cause an infinite loop resulting in CPU exhaustion. Versions 7.1.2.23 and 6.9.13-48 fix the issue.2d CVE-2023-301887.5 ALT

73.3%

——22Memory Exhaustion vulnerability in ONLYOFFICE Document Server 4.0.3 through 7.3.2 allows remote attackers to cause a denial of service via crafted JavaScript file.8d CVE-2022-233527.5 ALT

72.6%

——22An issue in BigAnt Software BigAnt Server v5.6.06 can lead to a Denial of Service (DoS).8d