Calling maskn(0) on a bn.js instance corrupts its internal big‑integer representation, causing several methods such as toString() and divmod() to enter an infinite loop that freezes the JavaScript process. This is a classic resource exhaustion flaw (CWE‑835) that results in a denial of service.

All JavaScript runtimes that include the open‑source bn.js library prior to version 5.2.3, for example Node.js applications that depend on indutny/bn.js for large‑integer arithmetic.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1 % suggests that real‑world exploitation is currently unlikely. The vulnerability is not listed in CISA KEV. Exploitation requires attacker‑controlled code to invoke maskn(0), implying a local or supply‑chain risk rather than a direct network‑exploitable vector.