Vulnerability in dependency bn.js CVE-2026-2739

[CarlyG55]

Problem:

The dependency asn1.js uses bn.js v^4.0.0. In this package it is set to v4.12.0. This has a vulnerability CVE-2026-2739

Solution:

Update this version of bn.js in the lockfile to 4.12.3 which resolves the vulnerability

[ShubhamChaturvedi7]

Hi @CarlyG55 ,

Thanks for reporting the vulnerability! We've released a fix in version 4.2.2: https://www.npmjs.com/package/@aws-crypto/client-node/v/4.2.2