PT-2026-105485 · Npm · Figlet
Published
2026-10-02
·
Updated
2026-10-02
CVSS v4.0
8.2
High
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Impact
A denial-of-service (infinite loop) can occur in
text() / textSync() when
both:whitespaceBreak: trueis set, andwidthis set smaller than the rendered width of a single FIGlet character. Under these conditionsbreakWord()could never find a valid break point, so the word-wrapping loop ingenerateFigTextLines()never terminated. This pins a CPU core and grows memory without bound, blocking the Node.js event loop.
Severity
Low or Medium. Triggering requires a non-default configuration (
whitespaceBreak: true) and
an attacker-controlled width value reaching text()/textSync(). This library is typically
used with fixed options, where this is not
reachable. Applications that pass an untrusted width together with
whitespaceBreak on a request path are affected.Patches
Fixed in figlet 1.11.3.
breakWord() now always makes forward progress
(emitting an over-wide character on its own line), and FIGlet header parsing now
rejects invalid values (e.g. zero/negative height).Workarounds
Do not expose
width to untrusted input, or leave whitespaceBreak disabled
(the default), or upgrade to 1.11.3.Fix
Infinite Loop
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Figlet