CVE-2026-33891
Fixed in a distro release EPSS <1%CVSS 7.5
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() function (inherited from the bundled jsbn library). When modInverse() is called with a zero value as input, the internal Extended Euclidean Algorithm enters an unreachable exit condition, causing the process to hang indefinitely and consume 100% CPU. Version 1.4.0 patches the issue.
Products: digitalbazaar forge, Red Hat Ansible Automation Platform 2.5 for RHEL 8, Red Hat Ansible Automation Platform 2.5 for RHEL 9, Red Hat Ansible Automation Platform 2.6 for RHEL 9, Red Hat Cluster Observability Operator 1.5.0, Red Hat Developer Hub 1.8, Red Hat Developer Hub 1.9, Red Hat Cryostat 4, Logging Subsystem for Red Hat OpenShift, Red Hat Ansible Automation Platform 2, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apicurio Registry 2, Red Hat Build of Podman Desktop, Red Hat Data Grid 8, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat Process Automation 7, Red Hat Quay 3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| npm | node-forge | 1.4.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | arangodb-3.11 | 3.11.14.4-r10 |
| Chainguard | arangodb-3.12 | 3.12.9.4-r4 |
| Chainguard | gitlab-rails-ce-18.1 | 18.1.6-r25 |
| Chainguard | gitlab-rails-ce-18.10 | no fix |
| Chainguard | gitlab-rails-ce-18.11 | 18.11.6-r7 |
| Chainguard | gitlab-rails-ce-18.5 | no fix |
| Chainguard | gitlab-rails-ce-18.6 | no fix |
| Chainguard | gitlab-rails-ce-18.7 | no fix |
| Chainguard | gitlab-rails-ce-18.8 | no fix |
| Chainguard | gitlab-rails-ce-18.9 | no fix |
| Chainguard | gitlab-rails-ce-19.0 | 19.0.5-r1 |
| Chainguard | gitlab-rails-ce-19.1 | 19.1.2-r6 |
| Chainguard | gitlab-rails-ce-fips-18.1 | 18.1.6-r87 |
| Chainguard | gitlab-rails-ce-fips-18.10 | 18.10.8-r8 |
| Chainguard | gitlab-rails-ce-fips-18.11 | 18.11.7-r1 |
| Chainguard | gitlab-rails-ce-fips-18.5 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.6 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.7 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.8 | no fix |
| Chainguard | gitlab-rails-ce-fips-18.9 | 18.9.8-r8 |
| Chainguard | gitlab-rails-ce-fips-19.0 | 19.0.4-r6 |
| Chainguard | gitlab-rails-ce-fips-19.1 | 19.1.3-r2 |
| Chainguard | gitlab-rails-ce-fips-19.2 | 19.2.1-r5 |
| Chainguard | katib-earlystopping | 0.19.0-r31 |
| Chainguard | katib-suggestion-goptuna-compat | no fix |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r31 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r40 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r31 |
| Chainguard | katib-suggestion-nas-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Chainguard | katib-tfevent-metricscollector | 0.19.0-r31 |
| Chainguard | kibana-7 | 7.17.29-r8 |
| Chainguard | kibana-8.17 | 8.17.10-r15 |
| Chainguard | kibana-8.17-bitnami | 8.17.10-r15 |
| Chainguard | kibana-8.17-iamguarded | 8.17.10-r15 |
| Chainguard | kibana-8.18 | 8.18.8-r11 |
| Chainguard | kibana-8.18-bitnami | 8.18.8-r11 |
| Chainguard | kibana-8.18-iamguarded | 8.18.8-r11 |
| Chainguard | kibana-8.19 | 8.19.14-r2 |
| Chainguard | kibana-8.19-bitnami | 8.19.14-r2 |
| Chainguard | kibana-8.19-iamguarded | 8.19.14-r2 |
| Chainguard | kibana-9.0 | 9.0.8-r16 |
| Chainguard | kibana-9.0-bitnami | 9.0.8-r16 |
| Chainguard | kibana-9.0-iamguarded | 9.0.8-r16 |
| Chainguard | kibana-9.1 | 9.1.10-r12 |
| Chainguard | kibana-9.1-iamguarded | 9.1.10-r12 |
| Chainguard | kibana-9.2 | 9.2.7-r5 |
| Chainguard | kibana-9.2-iamguarded | 9.2.7-r5 |
| Chainguard | kibana-9.3 | 9.3.3-r4 |
| Chainguard | kibana-9.3-iamguarded | 9.3.3-r3 |
| Chainguard | kibana-9.3-iamguarded | 9.3.3-r4 |
| Chainguard | kubeflow-centraldashboard | 1.10.0-r18 |
| Chainguard | kubeflow-pipelines-frontend | 2.16.0-r11 |
| Chainguard | opensearch-dashboards-2 | 2.19.5-r6 |
| Chainguard | opensearch-dashboards-2-fips | 2.19.5-r5 |
| Chainguard | opensearch-dashboards-3 | 3.5.0-r11 |
| Chainguard | wazuh-dashboard | 4.14.4-r1 |
| Chainguard | wazuh-dashboard-security-plugin-fips | 4.14.5-r10 |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.29-2.el9ap |
| Red Hat ansible automation platform 2.5 | automation-controller-venv-tower | 0:4.6.29-2.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-proxy-server | 0:2.5.10-6.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260422-3.el8ap |
| Red Hat ansible automation platform 2.5 | automation-gateway-server | 0:2.5.20260422-3.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-click | 0:8.3.3-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.5 | python3.12-cryptography | 0:46.0.7-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pillow | 0:12.2.0-1.el8ap |
| Red Hat ansible automation platform 2.5 | python3.12-pillow | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.5-1.el8ap |
| Red Hat ansible automation platform 2.5 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-cli | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-server | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-ui | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-controller-venv-tower | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-debugsource | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-gateway-proxy-server-debuginfo | 0:2.6.14-3.el9ap |
| Red Hat ansible automation platform 2.6 | automation-platform-ui | 0:2.6.9-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3-click | 0:8.3.3-1.el10ap |
| Red Hat ansible automation platform 2.6 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-cryptography-debuginfo | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-cryptography-debugsource | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow-debuginfo | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | python3.12-pillow-debugsource | 0:12.2.0-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptor-debuginfo | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptor-debuginfo | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptor-debugsource | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptor-debugsource | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform 2.6 | receptorctl | 0:1.6.5-1.el10ap |
| Red Hat ansible automation platform 2.6 | receptorctl | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-click | 0:8.3.3-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | python3.12-cryptography | 0:46.0.7-1.el8ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform developer 2.5 | receptor | 0:1.6.5-1.el8ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | automation-controller-cli | 0:4.7.12-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3-click | 0:8.3.3-1.el10ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-cryptography-debuginfo | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | python3.12-cryptography-debugsource | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform developer 2.6 | receptorctl | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-click | 0:8.3.3-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-cryptography | 0:46.0.7-1.el8ap |
| Red Hat ansible automation platform inside 2.5 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform inside 2.5 | receptor | 0:1.6.5-1.el8ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-click | 0:8.3.3-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-cryptography | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-cryptography-debuginfo | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | python3.12-cryptography-debugsource | 0:46.0.7-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | receptor | 0:1.6.5-1.el9ap |
| Red Hat ansible automation platform inside 2.6 | receptorctl | 0:1.6.5-1.el9ap |
| Ubuntu 20.04 LTS | node-node-forge | no fix |
| Ubuntu 22.04 LTS | node-node-forge | no fix |
| Wolfi | katib-earlystopping | 0.19.0-r31 |
| Wolfi | katib-suggestion-goptuna-compat | no fix |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r31 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r40 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r31 |
| Wolfi | katib-suggestion-nas-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r31 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r31 |
| Wolfi | katib-tfevent-metricscollector | 0.19.0-r31 |
| Wolfi | kubeflow-centraldashboard | 1.10.0-r18 |
| Wolfi | kubeflow-pipelines-frontend | 2.16.0-r11 |
| Wolfi | opensearch-dashboards-3 | 3.5.0-r11 |