CVE-2026-2739

What it actually does

The flaw is a denial-of-service condition in bn.js versions before 5.2.3. When maskn(0) is called on a BN instance, the library can corrupt the object's internal numeric state. Subsequent operations such as toString(), divmod(), and related big-number methods may enter an infinite loop, causing the Node.js process or any application thread executing that code path to hang indefinitely. The vulnerability does not directly provide code execution, data disclosure, or privilege escalation, but it can make affected services unavailable when attacker-controlled input can influence big-number operations.

Why it matters to the business

Applications that use vulnerable bn.js versions in request-handling, parsing, cryptographic, blockchain, token, payment, or numeric-processing paths may become unresponsive if exposed to crafted input that reaches the vulnerable call pattern. The most likely consequence is service degradation or outage, increased CPU consumption, failed transactions, timeouts, autoscaling cost increases, and operational disruption. The CVSS severity is moderate, EPSS is currently low, it is not listed in CISA KEV, and no mature public exploitation is indicated, so remediation should be prioritized based on whether vulnerable code is reachable from untrusted input or internet-facing workflows.

How an attack unfolds

An attacker first identifies an application or API that accepts input later converted into a BN object or used in logic that calls bn.js maskn(). If the application can be made to call maskn(0), the BN instance may become internally corrupted. The attacker then triggers additional processing that invokes toString(), divmod(), or another affected method on that corrupted instance. At that point the process can enter an infinite loop, consuming execution time and preventing normal request processing. Repeated requests can keep worker processes pinned or exhausted, resulting in denial of service for affected application components. Exploitation generally requires application-specific reachability; simply having bn.js installed is not sufficient unless the vulnerable method sequence can be triggered by data or workflows an attacker can influence.

How to fix it

Upgrade bn.js to version 5.2.3 or later wherever it appears as a direct or transitive dependency. If consuming the upstream Git repository directly, update to commit 33df26b5771e824f303a79ec6407409376baa64b or a later commit containing the fix. For SUSE Linux Enterprise Server 12 SP5 LTSS and LTSS Extended Security packages listed in the advisory data, update libpng16 to 1.6.8-15.12.1 or later through the vendor package channel. Regenerate lockfiles after dependency updates, rebuild containers and deployable artifacts, and verify that no vulnerable bn.js copy remains in nested dependency trees. As a temporary mitigation, prevent untrusted input from reaching code paths that can call maskn(0), add guards that reject or bypass zero-width mask calls, enforce request timeouts, isolate worker processes, and use process supervision to restart hung workers.

How to confirm the fix worked

Confirm the fix by generating a software bill of materials or dependency inventory and verifying that all bn.js instances resolve to 5.2.3 or later, or to the fixed upstream commit if vendored from Git. Use package-manager commands such as npm ls bn.js, yarn why bn.js, pnpm why bn.js, and lockfile searches to identify transitive copies. For SUSE systems, verify installed package versions with the platform package manager and confirm libpng16 is at 1.6.8-15.12.1 or later where applicable. Rebuild and redeploy artifacts after updating dependencies, then scan the final runtime image or deployment bundle rather than only source repositories. Functional validation should include regression tests for BN operations involving maskn(0), toString(), divmod(), and any application paths that process untrusted numeric input, confirming they return promptly and do not pin CPU.

Typical attack path

1. Discover a service, endpoint, parser, or workflow that uses bn.js for big-number handling.
2. Send crafted input that influences the application to create or manipulate a BN instance.
3. Trigger a code path that calls maskn(0) on that BN instance.
4. Cause the application to subsequently call toString(), divmod(), or another affected method on the corrupted BN object.
5. Repeat requests or maintain traffic until Node.js workers, job processors, or service instances hang and availability is degraded.

How to detect it

Because this issue causes an application hang rather than creating a distinctive file, process, or network artifact, detection depends on correlating application behavior with input patterns and dependency exposure. Review application, API gateway, load balancer, WAF, APM, and Node.js runtime telemetry for sudden request timeouts, event-loop stalls, sustained single-process CPU saturation, worker health-check failures, or restarts associated with endpoints that process large numbers, cryptographic values, blockchain data, tokens, payment amounts, or serialized numeric fields. Search request logs for suspicious payloads or parameters that may intentionally drive zero-width masking or edge-case numeric operations, especially repeated requests from the same source followed by latency spikes or worker hangs. In forensic review, inspect stack samples, core dumps, heap snapshots, CPU profiles, and APM traces for execution stuck in bn.js functions such as maskn, toString, divmod, or related BN prototype methods. Also search source and bundled artifacts for direct calls to maskn(0), because exploitation requires reachability of that call pattern.

• maskn(0)
• \.maskn(0)
• BN.prototype.maskn
• node_modules/bn.js/lib/bn.js
• bn.js/lib/bn.js
• bn.js
• maskn
• divmod
• toString
• RangeError: Maximum call stack size exceeded
• JavaScript heap out of memory
• event loop delay
• request timeout
• upstream timed out
• worker timeout
• health check failed

What your security team should do

• Inventory all applications, containers, serverless functions, and build artifacts that include bn.js, especially JavaScript and Node.js services exposed to untrusted input.
• Prioritize remediation for internet-facing APIs, blockchain or cryptographic services, payment/token processing, parsers, and job queues where attacker-controlled values may reach BN operations.
• Upgrade bn.js to 5.2.3 or later, update lockfiles, rebuild all deployable artifacts, and verify transitive dependencies no longer include vulnerable versions.
• Add defensive input validation and code guards to avoid calling maskn(0) on values influenced by untrusted input, even after patching.
• Deploy or tune request timeouts, worker recycling, health checks, circuit breakers, and autoscaling limits to reduce the operational impact of CPU-hang denial-of-service conditions.
• Monitor for unusual increases in request latency, event-loop delay, CPU saturation, worker restarts, queue backlog, and repeated requests to numeric-processing endpoints.
• Because EPSS is low and there is no KEV listing, track as a moderate-priority dependency remediation item unless reachable in a critical or internet-facing execution path, in which case treat as urgent availability risk.