CVE-2026-96780 in figlet.js
Summary
by MITRE • 10/02/2026
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/02/2026
The figlet.js library serves as a JavaScript implementation of the FIGfont specification, enabling developers to render text using ASCII art fonts within Node.js environments or browser-based applications. While this functionality provides aesthetic value for command-line interfaces and web displays, it introduces specific risks related to input validation and resource management when processing user-supplied data under certain configuration conditions. The vulnerability identified in versions prior to 1.11.3 centers on the interaction between whitespace handling logic and character width constraints during text rendering operations.
The core technical flaw resides within the internal functions responsible for breaking words into lines, specifically affecting the behavior of the text() and textSync() methods when the whitespaceBreak option is enabled. Under normal circumstances, these functions attempt to split long strings of text at spaces or other designated break points to fit them within a specified width limit. However, if an attacker controls both the input string and the target width parameter such that the width is smaller than the rendered width of even a single character from the FIGfont being used, the logic fails to identify any valid break point. In this scenario, the internal breakWord() function returns without consuming or advancing past any characters in the input stream.
This failure triggers an infinite loop within the generateFigTextLines() routine because it repeatedly attempts to process the same unprocessed character segment against a width constraint that can never be satisfied by standard whitespace breaks. As the library continues this cycle, it consumes significant CPU resources and causes memory usage to grow indefinitely due to the accumulation of intermediate rendering data structures. This constitutes a classic ReDoS-like denial-of-service vector where malicious input leads to resource exhaustion rather than code execution or data leakage. The vulnerability requires specific conditions to manifest: the whitespaceBreak option must be explicitly enabled, which is not always the default setting, and an attacker must have control over both the text content and the width parameter passed to the rendering function.
From a classification perspective, this issue aligns with CWE-835, Loop with Unreachable Exit Condition (Infinite Loop), as well as CWE-400, Resource Exhaustion, due to the unbounded consumption of CPU cycles and memory. In terms of attack vectors, it falls under ATT&CK technique T1496, Resource Hijacking, specifically within the context of computational resource exhaustion via application logic flaws rather than cryptographic weaknesses or buffer overflows. The impact is primarily availability-related, potentially causing service degradation or complete unresponsiveness for applications relying on figlet.js to render dynamic content based on user input.
Mitigation strategies focus heavily on version updates and defensive coding practices. The most effective remediation is upgrading the figlet.js dependency to version 1.11.3 or later, where this logic error has been corrected by ensuring that break points are handled correctly even when width constraints exceed character dimensions. For applications unable to upgrade immediately, developers should implement strict input validation and sanitization layers before passing data to rendering functions. This includes validating the width parameter against known maximum glyph widths for the selected font and rejecting or truncating inputs that would trigger unbounded loops. Additionally, implementing timeout mechanisms or resource limits at the application level can help contain potential denial-of-service impacts by terminating processes that exceed expected execution times or memory thresholds during text generation tasks.