CVE-2026-96780

Overview

CVE-2026-96780 is a high‑severity denial‑of‑service vulnerability in figlet.js that can cause an unbounded loop when whitespaceBreak is enabled and the width parameter is too small. The loop consumes CPU and memory, potentially exhausting system resources. It affects applications that use figlet.js versions prior to 1.11.3.

Description

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.

Impact

The vulnerability leads to a denial of service by exhausting CPU and memory resources, impacting any system or service that renders text using figlet.js. Defenders may experience degraded performance or crashes, affecting availability and potentially reliability of dependent services.

Remediation

Upgrade figlet.js to version 1.11.3 or later. If an upgrade is not immediately possible, disable the whitespaceBreak option or set the width parameter to a value larger than the rendered width of a single FIGlet character to prevent the loop.

Risk context

Severity is high with CVSS v3 score 7.5 and CVSS v4 score 8.2. No EPSS data is available, but the high scores indicate a significant risk if the vulnerable library is in use.

Affected products

• figlet.js