High, CVSS 8.2npmAmendedPublished
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
CVE-2026-96780 · GHSA-62ch-8vmq-8xm7
- Affected
- npm figlet < 1.11.3
- Fixed in
- 1.11.3· Vendor fix available
- Issue
- Impact A denial-of-service (infinite loop) can occur in text() / textSync() when both: - whitespaceBreak: true is set, and - width is set smaller than the rendered width of a single FIGlet character. Under these conditions breakWord() could never find a valid break point, so the word-wrapping loop in generateFigTextLines() never terminated. This pins a CPU core and grows memory without bound, blocking the Node.js event loop. Severity Low or Medium. Triggering requires a non-default configuration (whitespaceBreak: true) and an attacker-controlled width value reaching text()/textSync(). This library is typically used with fixed options, where this is not reachable. Applications that pass an untrusted width together with whitespaceBreak on a request path are affected. Patches Fixed in figlet 1.11.3. breakWord() now always makes forward progress (emitting an over-wide character on its own line), and FIGlet header parsing now rejects invalid values (e.g. zero/negative height). Workarounds…
Recommended action: Upgrade to 1.11.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.