Vulnerability · Published Oct 1, 2026 · Assigned by GitHub_M

CVE-2026-96780figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

High 8.2

In plain English

A high-severity infinite loop in figlet.js from patorjk. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.2High

Exploit odds (30 days)0.5%top 57.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
npm	figlet	1.11.3	GHSA-62ch-8vmq-8xm7

Affected products (as reported)

Vendor	Product	Versions
patorjk	figlet.js	< 1.11.3

Weakness: CWE-835 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References

https://github.com/patorjk/figlet.js/security/advisories/GHSA-62ch-8vmq-8xm7 x_refsource_CONFIRM
https://github.com/patorjk/figlet.js/pull/169 x_refsource_MISC
https://github.com/patorjk/figlet.js/commit/cb2839d0e53aeafbd361e9587abc72e49e41cbb3 x_refsource_MISC