figlet.js: Denial of service via unbounded loop with whitespaceBreak
Summary
figlet.js is a JavaScript FIGlet font renderer used in Node.js and browser applications, often as a transitive npm dependency. Versions before 1.11.3 can enter an unbounded loop in text() and textSync() when whitespaceBreak is enabled and width is smaller than a single rendered character, which consumes CPU and grows memory. Exploitation requires the non-default whitespaceBreak option and an attacker-controlled width value reaching the call, and the impact is limited to availability.
Affected
- figlet.js (npm package figlet) versions before 1.11.3
Fixed in
- Version 1.11.3 and later
Workaround
- Do not pass untrusted input as the width option.
- Keep whitespaceBreak disabled (the default).
- Upgrade to version 1.11.3 or later.
Exploitation
- No exploitation in the wild known.
- No public proof of concept known.
- CISA SSVC: exploitation none, automatable no, technical impact partial.
Our recommendation
- Identify all figlet installations in customer Node.js projects, including transitive dependencies (for example with npm ls figlet).
- Upgrade to figlet 1.11.3 or later.
- Validate or fix the width value where it comes from user input, or disable whitespaceBreak.
- Prioritise public-facing services; internal CLI-only use is lower risk.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-62ch-8vmq-8xm7 github.com
- Fix commit cb2839d github.com
- Pull Request #169 github.com
- OSV GHSA-62ch-8vmq-8xm7 osv.dev
- OSV CVE-2026-96780 osv.dev
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 17:36.
Original description (NVD)
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.