Disclosure summary
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.
Source-reported weakness categories
CWE-835
Source-specific records & product guidance
Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.
GitHub Reviewed Security Advisories · GHSA-62ch-8vmq-8xm7
Open original source · Updated Oct 02, 2026
figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
Source severity: HIGH / 8.2
| Ecosystem | Package | Affected range | First patched |
|---|---|---|---|
| npm | figlet | < 1.11.3 | 1.11.3 |
NIST National Vulnerability Database · NVD-CVE-2026-96780
Open original source · Updated Oct 02, 2026
Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.
Original records & references
PUBLISHED 2026-10-01T17:17:26-04:00
MODIFIED 2026-10-02T14:47:49-04:00
INGESTED 2026-10-06T11:45:14-04:00