CVE-2026-54461

Name of the Vulnerable Software and Affected Versions Habitica versions 4.172.1 through 5.48.1

Description A query parameter on the '/api/v3/groups/:groupId/members' endpoint is not sanitized before being interpreted as a regular expression. An authenticated caller can provide a computationally expensive regular expression, leading to degraded application performance or the halting of Node.js processes. This is a Regular Expression Denial of Service (ReDoS), where a specially crafted regex causes the engine to take an exponential amount of time to process the input.

Recommendations Update to version 5.48.2.