{"action":"Upgrade bn.js to 4.12.3 or later.","affected":[{"fixed":"4.12.3","introduced":"0"},{"fixed":"5.2.3","introduced":"5.0.0"}],"component":"bn.js","cve_ids":["CVE-2026-2739"],"ecosystem":"npm","epss":0.00531,"exploited":false,"fixed_versions":["4.12.3","5.2.3"],"ghsa_id":"GHSA-378v-28hj-76wf","id":"tcs_01M5KEWDGX0ATEBRGAGXJEJBF4","modified_at":"2026-09-10T03:50:33.815513385Z","published_at":"2026-02-20T06:30:39Z","references":["https://osv.dev/vulnerability/GHSA-378v-28hj-76wf","https://nvd.nist.gov/vuln/detail/CVE-2026-2739","https://github.com/indutny/bn.js/issues/186","https://github.com/indutny/bn.js/issues/316","https://github.com/indutny/bn.js/issues/316#issuecomment-3924217358","https://github.com/indutny/bn.js/pull/317","https://github.com/indutny/bn.js/commit/33df26b5771e824f303a79ec6407409376baa64b","https://gist.github.com/Kr0emer/02370d18328c28b5dd7f9ac880d22a91","https://github.com/indutny/bn.js","https://github.com/indutny/bn.js/releases/tag/v5.2.3","https://security.snyk.io/vuln/SNYK-JS-BNJS-15274301"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"GHSA-378v-28hj-76wf","url":"https://osv.dev/vulnerability/GHSA-378v-28hj-76wf"}],"summary":"bn.js affected by an infinite loop"}