GHSA-62CH-8VMQ-8XM7

Vulnerability from github – Published: 2026-10-02 22:39 – Updated: 2026-10-02 22:39
VLAI
Summary
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
Details

Impact

A denial-of-service (infinite loop) can occur in text() / textSync() when both: - whitespaceBreak: true is set, and - width is set smaller than the rendered width of a single FIGlet character. Under these conditions breakWord() could never find a valid break point, so the word-wrapping loop in generateFigTextLines() never terminated. This pins a CPU core and grows memory without bound, blocking the Node.js event loop.

Severity

Low or Medium. Triggering requires a non-default configuration (whitespaceBreak: true) and an attacker-controlled width value reaching text()/textSync(). This library is typically used with fixed options, where this is not reachable. Applications that pass an untrusted width together with whitespaceBreak on a request path are affected.

Patches

Fixed in figlet 1.11.3. breakWord() now always makes forward progress (emitting an over-wide character on its own line), and FIGlet header parsing now rejects invalid values (e.g. zero/negative height).

Workarounds

Do not expose width to untrusted input, or leave whitespaceBreak disabled (the default), or upgrade to 1.11.3.

Severity
8.2 (High)
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "figlet"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.11.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-96780"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-835"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-10-02T22:39:16Z",
    "nvd_published_at": "2026-10-01T21:17:26Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nA denial-of-service (infinite loop) can occur in `text()` / `textSync()` when\n**both**:\n- `whitespaceBreak: true` is set, **and**\n- `width` is set smaller than the rendered width of a single FIGlet character.\nUnder these conditions `breakWord()` could never find a valid break point, so the\nword-wrapping loop in `generateFigTextLines()` never terminated. This pins a CPU\ncore and grows memory without bound, blocking the Node.js event loop.\n\n### Severity\nLow or Medium. Triggering requires a non-default configuration (`whitespaceBreak: true`) and\nan attacker-controlled `width` value reaching `text()`/`textSync()`. This library is typically\nused with fixed options, where this is not\nreachable. Applications that pass an untrusted `width` together with\n`whitespaceBreak` on a request path are affected.\n\n### Patches\nFixed in **figlet 1.11.3**. `breakWord()` now always makes forward progress\n(emitting an over-wide character on its own line), and FIGlet header parsing now\nrejects invalid values (e.g. zero/negative height).\n\n### Workarounds\nDo not expose `width` to untrusted input, or leave `whitespaceBreak` disabled\n(the default), or upgrade to 1.11.3.",
  "id": "GHSA-62ch-8vmq-8xm7",
  "modified": "2026-10-02T22:39:16Z",
  "published": "2026-10-02T22:39:16Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/patorjk/figlet.js/security/advisories/GHSA-62ch-8vmq-8xm7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96780"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patorjk/figlet.js/pull/169"
    },
    {
      "type": "WEB",
      "url": "https://github.com/patorjk/figlet.js/commit/cb2839d0e53aeafbd361e9587abc72e49e41cbb3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/patorjk/figlet.js"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.