Vulnerability · Published Sep 24, 2026 · Assigned by GitHub_M

CVE-2026-54461Habitica: Regex Injection / ReDoS in Member Search

Medium 6.5

In plain English

A medium-severity regular-expression denial of service in habitica from HabitRPG. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 22% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.3%top 77.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.

Affected products (as reported)

Vendor	Product	Versions
HabitRPG	habitica	>= 4.172.1, < 5.48.2

Weakness: CWE-1333 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58 x_refsource_CONFIRM
https://github.com/HabitRPG/habitica/commit/7b7dc255dff1564935675399ff168e8a91b8afca x_refsource_MISC
https://github.com/HabitRPG/habitica/releases/tag/v5.48.2 x_refsource_MISC