Read the docs
TI-2026-63867 Aliases CVE-2026-96780GHSA-62ch-8vmq-8xm7

figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

Priority LOW 36CWE-835Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-835.

Summary

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00495 42nd percentileScored 2026-11-07
Fix Fixed figlet.js (patorjk): 1.11.3figlet (npm): 1.11.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
patorjkfiglet.jsbefore 1.11.31.11.3Patch availableCNA
—figlet (npm)before 1.11.31.11.3Patch availableGHSA-62ch-8vmq-8xm7
  • figlet.js Vendorpatorjk Affected before 1.11.3 Fixed in 1.11.3 Patch available CNA
  • figlet (npm) Vendor— Affected before 1.11.3 Fixed in 1.11.3 Patch available GHSA-62ch-8vmq-8xm7

Remediation

  • Fix · CNA figlet.js (patorjk) Fixed in 1.11.3
  • Fix · GHSA-62ch-8vmq-8xm7 figlet (npm) Fixed in 1.11.3 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-96780
  2. 2026-10-03 Alias added: GHSA-62ch-8vmq-8xm7

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences