{"id":"EUVD-2026-16833","revision":"f3e05e0a892a46abb72e7492231c35d5","records":[{"revision":"f3e05e0a892a46abb72e7492231c35d5","observedAt":"2026-10-30T05:00:43.82+00:00","statement":{"source":"euvd","id":"EUVD-2026-16833","aliases":["CVE-2026-33891","GHSA-5m6q-g25r-mvwx"],"title":"Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigIntege…","description":"Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":null}],"references":["https://github.com/digitalbazaar/forge/security/advisories/GHSA-5m6q-g25r-mvwx","https://github.com/digitalbazaar/forge/commit/9bb8d67b99d17e4ebb5fd7596cd699e11f25d023"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-16833","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Mar 27, 2026, 8:43:37 PM","dateUpdated":"Sep 4, 2026, 12:04:56 PM"},"relatedAdvisories":[{"id":"RHSA-2026:24761","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2025-62718","CVE-2026-4926","CVE-2026-7246","CVE-2026-26996","CVE-2026-27904","CVE-2026-30922","CVE-2026-32280","CVE-2026-32282","CVE-2026-32283","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39363","CVE-2026-39892","CVE-2026-40192"]},{"id":"RHSA-2026:13826","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.9.4 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-32280","CVE-2026-32282","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175","CVE-2026-40895"]},{"id":"WID-SEC-W-2026-1407","title":"IBM App Connect Enterprise Certified Container: Mehrere Schwachstellen","vulnerabilityIds":["CVE-2026-26013","CVE-2026-27142","CVE-2026-28277","CVE-2026-28684","CVE-2026-32288","CVE-2026-33151","CVE-2026-33349","CVE-2026-33532","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-33916","CVE-2026-34601","CVE-2026-35469","CVE-2026-39406","CVE-2026-39407","CVE-2026-39408","CVE-2026-39409","CVE-2026-39410","CVE-2026-39983","CVE-2026-40175","CVE-2026-40347","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-4923","CVE-2026-4926"]},{"id":"RHSA-2026:9742","title":"Red Hat Security Advisory: Red Hat Developer Hub 1.8.6 release.","vulnerabilityIds":["CVE-2025-62718","CVE-2025-69534","CVE-2025-69873","CVE-2026-1525","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-3118","CVE-2026-4800","CVE-2026-4926","CVE-2026-25679","CVE-2026-26996","CVE-2026-27601","CVE-2026-27904","CVE-2026-29063","CVE-2026-29074","CVE-2026-29186","CVE-2026-32141","CVE-2026-33036","CVE-2026-33228","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39983","CVE-2026-40175"]},{"id":"msrc_CVE-2026-33891","title":"Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input","vulnerabilityIds":["CVE-2026-33891"]},{"id":"RHSA-2026:24762","title":"Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update","vulnerabilityIds":["CVE-2026-4800","CVE-2026-4926","CVE-2026-7246","CVE-2026-30922","CVE-2026-32280","CVE-2026-32282","CVE-2026-32283","CVE-2026-33891","CVE-2026-39363","CVE-2026-39892","CVE-2026-40175","CVE-2026-40192"]},{"id":"RHSA-2026:34342","title":"Red Hat Security Advisory: Cluster Observability Operator 1.5.0","vulnerabilityIds":["CVE-2020-7753","CVE-2021-33623","CVE-2024-4068","CVE-2024-45338","CVE-2024-52011","CVE-2025-22868","CVE-2025-22870","CVE-2025-22872","CVE-2025-47911","CVE-2025-58190","CVE-2026-1526","CVE-2026-1528","CVE-2026-2229","CVE-2026-4800","CVE-2026-4867","CVE-2026-6321","CVE-2026-6322","CVE-2026-6734","CVE-2026-9277","CVE-2026-9697","CVE-2026-12143","CVE-2026-12151","CVE-2026-25680","CVE-2026-25681","CVE-2026-29063","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33814","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-33937","CVE-2026-33938","CVE-2026-33939","CVE-2026-33940","CVE-2026-33941","CVE-2026-39821","CVE-2026-42506","CVE-2026-48779"]},{"id":"RHSA-2026:86618","title":"Red Hat Security Advisory: New container image: rhceph-9.2","vulnerabilityIds":["CVE-2023-46159","CVE-2024-47866","CVE-2024-48916","CVE-2024-55565","CVE-2025-12816","CVE-2025-15599","CVE-2025-26791","CVE-2025-30156","CVE-2025-50181","CVE-2025-50182","CVE-2025-58754","CVE-2025-59343","CVE-2025-62718","CVE-2025-66030","CVE-2025-66035","CVE-2025-66412","CVE-2025-69873","CVE-2026-0540","CVE-2026-21441","CVE-2026-22610","CVE-2026-25639","CVE-2026-26996","CVE-2026-27903","CVE-2026-27904","CVE-2026-27970","CVE-2026-32141","CVE-2026-33228","CVE-2026-33671","CVE-2026-33672","CVE-2026-33891","CVE-2026-33894","CVE-2026-33895","CVE-2026-33896","CVE-2026-39865","CVE-2026-40175","CVE-2026-40895","CVE-2026-41238","CVE-2026-41239","CVE-2026-41240","CVE-2026-41305","CVE-2026-42033","CVE-2026-42034","CVE-2026-42035","CVE-2026-42036","CVE-2026-42037","CVE-2026-42038","CVE-2026-42039","CVE-2026-42040","CVE-2026-42041","CVE-2026-42042","CVE-2026-42043","CVE-2026-42044","CVE-2026-50152","CVE-2026-58224"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-16833","identifiers":["EUVD-2026-16833","CVE-2026-33891","GHSA-5m6q-g25r-mvwx"]},"retained":false,"historicalAffected":[]}],"coverage":[]}