node-forge CVE-2026-118781

Exploitable only when the application passes an attacker-controlled RSA public exponent 'e' into forge.pki.rsa.generateKeyPair(), forge.pki.rsa.createKeyPairGenerationState(), or forge.pki.rsa.stepKeyPairGenerationState(), or calls forge.jsbn.BigInteger#modInverse() directly with a negative value or modulus derived from untrusted input. A negative (or otherwise sign-negative) operand is required; RFC 8017 requires e >= 3, so compliant exponents like 65537 never trigger it. Key limiting factors: the trigger is reachable only through the pure-JavaScript code path (any exponent other than 3 or 65537), it requires the application to forward untrusted input to key generation (a non-default, application-specific code path), and values node-forge parses from DER, PEM, JWK, PKCS#12, X.509, and TLS are always unsigned and CANNOT reach this bug. Impact is limited to CPU exhaustion / event-loop blocking; there is no confidentiality or integrity effect and memory does not grow.

This is a genuinely low-priority issue, and the available signals agree. The CVSS 3.1 base score is 2.9 (Low) with vector CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L - local attack vector, high complexity, no privileges, no user interaction, and availability-only impact (no confidentiality or integrity loss). The vuln.today decision label is 'monitor', consistent with the low score. No EPSS score was provided in the input, and there is no CISA KEV listing, so there is no evidence of active exploitation. A public proof-of-concept does exist inside the GHSA-h6cr-wjv9-3cpp advisory (a three-line snippet that hangs the process), but this demonstrates only the denial-of-service hang, not code execution or data compromise. The practical risk is tightly bounded by the trigger condition: the flaw is only reachable when an application passes an attacker-controlled RSA public exponent to node-forge key generation, or calls BigInteger#modInverse() directly with negative untrusted operands. The advisory explicitly states that all values node-forge parses (DER, PEM, JWK, PKCS#12, X.509, TLS) are read as unsigned and cannot trigger the issue, and that documented key-generation usage passes a constant exponent (65537). Note a minor cross-signal nuance: the vendor CVSS 3.1 vector uses AC:H while the informational CVSS 4.0 vector uses AC:L with AT:P (present attack requirement); both rate the issue Low and the vendor states the 3.1 rating governs. The realistic worst case is a single-threaded Node.js process spinning at 100% CPU with its event loop blocked; memory does not grow.

An application exposes RSA key generation and forwards a user-supplied public exponent directly into forge.pki.rsa.generateKeyPair({e: ...}) (or the createKeyPairGenerationState/stepKeyPairGenerationState variants). An attacker submits a negative exponent such as e = -1, which reaches BigInteger.modInverse() and enters an infinite loop, pinning the CPU and blocking the Node.js event loop so the service stops handling all other requests. A public proof-of-concept demonstrating the hang is included in the GHSA advisory.