CVE-2026-54461: Habitica: Regex Injection / ReDoS in Member Search
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Habiticato a version that resolves this vulnerability.Fixed in 5.48.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated caller can exploit it by sending a crafted query parameter to the /api/v3/groups/:groupId/members endpoint. No user interaction is required.
Which Habitica versions are affected?
Habitica versions from 4.172.1 until 5.48.2 are affected. The issue is fixed in version 5.48.2.
What is the operational impact of exploitation?
A crafted computationally expensive regular expression can degrade application performance or halt Node.js processes. The reported impact is availability only; confidentiality and integrity are not affected.