CVE-2026-96780: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
figletto a version that resolves this vulnerability.Fixed in 1.11.3
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Deployments using figlet.js before 1.11.3 are exposed only if they enable the non-default whitespaceBreak option and allow an attacker-controlled width to reach text() or textSync().
What input conditions are needed to trigger the issue?
WhitespaceBreak must be enabled and the supplied width must be smaller than the rendered width of a single FIGlet character. Under those conditions, processing can repeatedly handle the same input without consuming characters.
What is the impact if exploitation succeeds?
The affected call can enter an unbounded loop, consuming CPU and growing memory. This can cause denial of service for the process handling the request or input.
What should be done if an immediate upgrade is not possible?
Do not enable whitespaceBreak for affected calls, and prevent attacker-controlled widths from reaching text() or textSync(). Ensure any width used with whitespaceBreak is not smaller than the rendered width of a single FIGlet character.
How is the issue fixed?
Upgrade figlet.js to version 1.11.3, which fixes the unbounded-loop condition.