patorjk figlet.js up to 1.11.2 Text Processing text/textSync infinite loop

Summaryinfo

A vulnerability categorized as problematic has been discovered in patorjk figlet.js up to 1.11.2. This issue affects the function text/textSync of the component Text Processing. The manipulation results in infinite loop. This vulnerability is reported as CVE-2026-96780. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.

Detailsinfo

A vulnerability classified as problematic has been found in patorjk figlet.js up to 1.11.2. Affected is the function text/textSync of the component Text Processing. The manipulation with an unknown input leads to a infinite loop vulnerability. CWE is classifying the issue as CWE-835. The product contains an iteration or loop with an exit condition that cannot be reached, i.e., an infinite loop. This is going to have an impact on availability. CVE summarizes:

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.

The advisory is shared for download at github.com. This vulnerability is traded as CVE-2026-96780 since 09/23/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1499.

Upgrading to version 1.11.3 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• JavaScript Library

Vendor

• patorjk

Name

• figlet.js

Version

• 1.11.0
• 1.11.1
• 1.11.2

Website

• Product: https://github.com/patorjk/figlet.js/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion