NodeJS/bn.js/5.1.2
Big number implementation in pure javascript
https://www.npmjs.com/package/bn.js
MIT
1 Security Vulnerabilities
bn.js affected by an infinite loop
Published date: 2026-02-20T06:30:39Z
CVE: CVE-2026-2739
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2026-2739
- https://github.com/indutny/bn.js/issues/186
- https://github.com/indutny/bn.js/issues/316
- https://github.com/indutny/bn.js/pull/317
- https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b
- https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91
- https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301
- https://github.com/indutny/bn.js/releases/tag/v5.2.3
- https://github.com/advisories/GHSA-378v-28hj-76wf
- https://github.com/indutny/bn.js/issues/316#issuecomment-3924217358
This affects versions of the package bn.js before 4.12.3 and 5.2.3. Calling maskn(0) on any BN instance corrupts the internal state, causing toString(), divmod(), and other methods to enter an infinite loop, hanging the process indefinitely.
Affected versions: ["5.2.2", "5.2.1", "5.2.0", "5.1.3", "5.1.2", "5.1.1", "5.1.0", "5.0.0", "4.12.2", "4.12.1", "4.12.0", "4.11.9", "4.11.8", "4.11.7", "4.11.6", "4.11.5", "4.11.4", "4.11.3", "4.11.2", "4.11.1", "4.11.0", "4.10.5", "4.10.4", "4.10.3", "4.10.2", "4.10.1", "4.10.0", "4.9.0", "4.8.1", "4.8.0", "4.7.0", "4.6.6", "4.6.5", "4.6.4", "4.6.3", "4.6.2", "4.6.1", "4.6.0", "4.5.2", "4.5.1", "4.5.0", "4.4.0", "4.3.0", "4.2.0", "4.1.1", "4.1.0", "4.0.0", "3.3.0", "3.2.0", "3.1.2", "3.1.1", "3.1.0", "3.0.1", "3.0.0", "2.2.0", "2.1.0", "2.0.5", "2.0.4", "2.0.3", "2.0.2", "2.0.1", "2.0.0", "1.3.0", "1.2.4", "1.2.3", "1.2.2", "1.2.1", "1.1.1", "1.1.0", "1.0.0", "0.16.1", "0.16.0", "0.15.2", "0.15.1", "0.15.0", "0.14.2", "0.14.1", "0.14.0", "0.13.3", "0.13.2", "0.13.1", "0.13.0", "0.12.0", "0.11.7", "0.11.6", "0.11.5", "0.11.4", "0.11.3", "0.11.2", "0.11.1", "0.11.0", "0.10.1", "0.10.0", "0.9.0", "0.8.1", "0.8.0", "0.7.1", "0.7.0", "0.6.0", "0.5.4", "0.5.3", "0.5.2", "0.5.1", "0.5.0", "0.4.4", "0.4.3", "0.4.2", "0.4.1", "0.4.0", "0.3.1", "0.3.0", "0.2.2", "0.2.1", "0.2.0", "0.1.7", "0.1.6", "0.1.5", "0.1.4", "0.1.3", "0.1.2", "0.1.1", "0.1.0"]
Secure versions: [4.12.3, 5.2.3]
Recommendation: Update to version 5.2.3.
124 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 5.2.3 | MIT | 2026-02-19 - 01:43 | about 1 month | |
| 5.2.2 | MIT | 1 | 2025-04-25 - 15:51 | 11 months |
| 5.2.1 | MIT | 1 | 2022-05-24 - 10:36 | almost 4 years |
| 5.2.0 | MIT | 1 | 2021-02-23 - 20:02 | about 5 years |
| 5.1.3 | MIT | 1 | 2020-08-14 - 18:04 | over 5 years |
| 5.1.2 | MIT | 1 | 2020-05-20 - 15:24 | almost 6 years |
| 5.1.1 | MIT | 1 | 2019-12-24 - 20:33 | about 6 years |
| 5.1.0 | MIT | 1 | 2019-12-23 - 08:42 | about 6 years |
| 5.0.0 | MIT | 1 | 2019-07-07 - 16:17 | over 6 years |
| 4.12.3 | MIT | 2026-02-19 - 01:49 | about 1 month | |
| 4.12.2 | MIT | 1 | 2025-04-25 - 16:18 | 11 months |
| 4.12.1 | MIT | 1 | 2024-11-11 - 15:19 | over 1 year |
| 4.12.0 | MIT | 1 | 2021-02-24 - 07:16 | about 5 years |
| 4.11.9 | MIT | 1 | 2020-05-20 - 15:13 | almost 6 years |
| 4.11.8 | MIT | 1 | 2017-08-07 - 22:21 | over 8 years |
| 4.11.7 | MIT | 1 | 2017-06-21 - 00:08 | almost 9 years |
| 4.11.6 | MIT | 1 | 2016-08-02 - 01:13 | over 9 years |
| 4.11.5 | MIT | 1 | 2016-07-13 - 20:37 | over 9 years |
| 4.11.4 | MIT | 1 | 2016-06-05 - 20:32 | almost 10 years |
| 4.11.3 | MIT | 1 | 2016-04-12 - 19:25 | almost 10 years |
| 4.11.2 | MIT | 1 | 2016-04-12 - 19:03 | almost 10 years |
| 4.11.1 | MIT | 1 | 2016-03-25 - 22:35 | almost 10 years |
| 4.11.0 | MIT | 1 | 2016-03-08 - 18:40 | about 10 years |
| 4.10.5 | MIT | 1 | 2016-03-01 - 06:05 | about 10 years |
| 4.10.4 | MIT | 1 | 2016-02-27 - 01:11 | about 10 years |
| 4.10.3 | MIT | 1 | 2016-02-09 - 02:48 | about 10 years |
| 4.10.2 | MIT | 1 | 2016-02-09 - 02:43 | about 10 years |
| 4.10.1 | MIT | 1 | 2016-02-04 - 22:38 | about 10 years |
| 4.10.0 | MIT | 1 | 2016-02-01 - 04:39 | about 10 years |
| 4.9.0 | MIT | 1 | 2016-01-27 - 21:16 | about 10 years |
| 4.8.1 | MIT | 1 | 2016-01-25 - 20:30 | about 10 years |
| 4.8.0 | MIT | 1 | 2016-01-25 - 02:59 | about 10 years |
| 4.7.0 | MIT | 1 | 2016-01-24 - 21:33 | about 10 years |
| 4.6.6 | MIT | 1 | 2016-01-22 - 18:32 | about 10 years |
| 4.6.5 | MIT | 1 | 2016-01-21 - 23:27 | about 10 years |
| 4.6.4 | MIT | 1 | 2016-01-14 - 04:04 | about 10 years |
| 4.6.3 | MIT | 1 | 2016-01-13 - 20:31 | about 10 years |
| 4.6.2 | MIT | 1 | 2016-01-04 - 14:12 | about 10 years |
| 4.6.1 | MIT | 1 | 2015-12-19 - 22:35 | over 10 years |
| 4.6.0 | MIT | 1 | 2015-12-19 - 22:34 | over 10 years |
| 4.5.2 | MIT | 1 | 2015-12-15 - 01:28 | over 10 years |
| 4.5.1 | MIT | 1 | 2015-12-11 - 05:08 | over 10 years |
| 4.5.0 | MIT | 1 | 2015-12-04 - 01:51 | over 10 years |
| 4.4.0 | MIT | 1 | 2015-11-29 - 18:22 | over 10 years |
| 4.3.0 | MIT | 1 | 2015-11-22 - 01:45 | over 10 years |
| 4.2.0 | MIT | 1 | 2015-11-18 - 15:53 | over 10 years |
| 4.1.1 | MIT | 1 | 2015-11-01 - 15:49 | over 10 years |
| 4.1.0 | MIT | 1 | 2015-10-29 - 00:30 | over 10 years |
| 4.0.0 | MIT | 1 | 2015-10-28 - 02:16 | over 10 years |
| 3.3.0 | MIT | 1 | 2015-10-27 - 17:13 | over 10 years |