CVE-2026-54461: Habitica DOS Vulnerability

CVE-2026-54461 Overview

Habitica is a habit tracker application that treats goals like a role-playing game. A regular expression denial of service (ReDoS) vulnerability affects the /api/v3/groups/:groupId/members endpoint. The search query parameter is passed directly into a RegExp constructor without sanitization. An authenticated attacker can submit a computationally expensive pattern that degrades application performance or halts Node.js worker processes. The flaw is tracked under [CWE-1333] (Inefficient Regular Expression Complexity) and is fixed in version 5.48.2.

Critical Impact

Any authenticated Habitica user can trigger high CPU consumption on the backend, resulting in service degradation or full denial of service for the application.

Affected Products

• Habitica versions 4.172.1 through 5.48.1
• Habitica Node.js backend API (website/server/controllers/api-v3/members.js)
• Self-hosted Habitica deployments running affected releases

Discovery Timeline

• 2026-09-24 - CVE-2026-54461 published to NVD
• 2026-09-30 - Last updated in NVD database

Technical Details for CVE-2026-54461

Vulnerability Analysis

The vulnerability resides in the group members search handler. When a client calls GET /api/v3/groups/:groupId/members with a search query parameter, the controller builds a MongoDB $or query containing two $regex clauses. One clause wraps the user input with escapeRegExp before constructing a RegExp. The second clause, matching against auth.local.username, uses the raw req.query.search value without escaping. An authenticated attacker can therefore supply a pattern with catastrophic backtracking, such as nested quantifiers against a long input. Node.js is single-threaded for JavaScript execution, so a stalled regex evaluation blocks the event loop and prevents the process from serving other requests.

Root Cause

The root cause is missing input sanitization before dynamic regular expression construction. Only one of two parallel $regex branches invoked escapeRegExp, leaving the username branch to interpret attacker-controlled metacharacters as regex syntax. This allows crafting expressions whose matching complexity grows exponentially with input length.

Attack Vector

Exploitation requires an authenticated account and network access to the API. The attacker issues a single HTTP request to the members endpoint with a malicious search value. No elevated privileges, user interaction, or special group membership are required beyond standard API authentication.

// Patch from website/server/controllers/api-v3/members.js
        const escapedSearch = escapeRegExp(req.query.search);
        query.$or = [
          { 'profile.name': { $regex: new RegExp(escapedSearch, 'i') } },
-         { 'auth.local.username': { $regex: new RegExp(req.query.search, 'i') } },
+         { 'auth.local.username': { $regex: new RegExp(escapedSearch, 'i') } },
        ];
      }
    } else if (type === 'group-invites') {
// Source: https://github.com/HabitRPG/habitica/commit/7b7dc255dff1564935675399ff168e8a91b8afca

The patch applies the existing escapedSearch value to both branches so that regex metacharacters in user input are treated as literals.

Detection Methods for CVE-2026-54461

Indicators of Compromise

• Sustained high CPU usage on Habitica Node.js processes correlated with requests to /api/v3/groups/:groupId/members.
• Requests to the members endpoint containing search parameters with nested quantifiers such as (a+)+, (.*)*, or long repeating character classes.
• Elevated API response latency or event loop lag metrics coinciding with authenticated traffic from a single account.

Detection Strategies

• Log and inspect all search query parameter values submitted to /api/v3/groups/:groupId/members for suspicious regex metacharacters.
• Alert on Node.js event loop lag exceeding normal baselines for the Habitica API tier.
• Correlate authenticated user IDs with per-request CPU time to identify abusive callers.

Monitoring Recommendations

• Instrument the backend with APM tooling that reports per-endpoint latency and CPU attribution.
• Rate-limit the members search endpoint on a per-user basis and log rejections for review.
• Forward web server and application logs to a centralized analytics platform for retroactive hunting on known ReDoS patterns.

How to Mitigate CVE-2026-54461

Immediate Actions Required

• Upgrade Habitica to version 5.48.2 or later across all production and staging environments.
• Audit API access logs for prior requests to /api/v3/groups/:groupId/members with unusual search parameters.
• Restrict or temporarily disable the members search endpoint if patching cannot be completed immediately.

Patch Information

The fix is included in Habitica Release v5.48.2. The code change is tracked in GitHub commit 7b7dc25 and documented in GitHub Security Advisory GHSA-x772-22c9-gq58. The patch escapes the search parameter before passing it to the RegExp constructor on the auth.local.username branch.

Workarounds

• Deploy a reverse-proxy or WAF rule that rejects search values containing regex metacharacters or exceeding a sane length limit.
• Enforce strict per-user rate limiting on /api/v3/groups/:groupId/members to cap the throughput of ReDoS attempts.
• Run the Node.js API with a process supervisor and worker timeout so stalled requests are terminated rather than blocking the event loop indefinitely.

# Example nginx rule to reject suspicious search patterns
location ~ ^/api/v3/groups/[^/]+/members$ {
    if ($arg_search ~* "[\\.\\*\\+\\?\\(\\)\\[\\]\\{\\}\\|\\\\]") {
        return 400;
    }
    if ($arg_search ~* ".{128,}") {
        return 400;
    }
    proxy_pass http://habitica_backend;
}