CVE-2026-96780: figlet.js DOS Vulnerability

CVE-2026-96780 Overview

CVE-2026-96780 is a denial of service vulnerability in figlet.js, a JavaScript implementation of the FIGfont specification. The flaw affects versions prior to 1.11.3 and resides in the text() and textSync() rendering functions. When the whitespaceBreak option is enabled and the width parameter is smaller than the rendered width of a single FIGlet character, the internal breakWord() function cannot find a valid break point. The function returns without consuming a character, causing generateFigTextLines() to repeatedly process the same input. The result is unbounded CPU consumption and growing memory usage, classified under [CWE-835] Loop with Unreachable Exit Condition.

Critical Impact

Attackers who control both the width argument and reach an affected call can trigger an infinite loop, exhausting server CPU and memory resources.

Affected Products

• figlet.js versions prior to 1.11.3
• Node.js applications that expose text() or textSync() with user-controllable width parameters
• Server-side rendering pipelines invoking figlet.js with whitespaceBreak enabled

Discovery Timeline

• 2026-10-01 - CVE-2026-96780 published to NVD
• 2026-10-02 - Last updated in NVD database

Technical Details for CVE-2026-96780

Vulnerability Analysis

The vulnerability resides in the word-breaking logic of figlet.js. The breakWord() function is responsible for finding a suitable break point when a rendered line exceeds the configured width. When the requested width is smaller than the width of a single FIGlet character, no valid break point exists. The function returns the input unchanged without consuming any characters. The outer generateFigTextLines() loop checks whether progress has been made before iterating again, but because the character array is unchanged, the loop re-enters breakWord() with the same input indefinitely.

This non-terminating loop blocks the Node.js event loop, degrading or halting the entire process. Memory grows as intermediate structures accumulate during each iteration.

Root Cause

The root cause is missing forward-progress enforcement in breakWord(). The function did not account for the case where a single FIGlet glyph exceeds the caller's requested width, leaving the loop invariant unsatisfiable.

Attack Vector

Exploitation requires reaching an affected call path with whitespaceBreak: true and an attacker-controlled width value smaller than one glyph. The attack is network-reachable where an application exposes figlet rendering through an HTTP endpoint, chat bot, logging frontend, or similar service that accepts user-supplied formatting parameters. No authentication or user interaction is required when such an endpoint exists.

         };
       }
     }
+    // No break point fits within opts.width, which happens when a single
+    // character is wider than the requested width. Emit the first character
+    // on its own line so the caller always makes forward progress; otherwise
+    // the while-loop in generateFigTextLines would spin forever.
+    if (figChars.length > 0) {
+      return {
+        outputFigText: joinFigArray([figChars[0]], len, opts),
+        chars: figChars.slice(1),
+      };
+    }
     return { outputFigText: newFigChar(len), chars: figChars };
   }

Source: GitHub Commit cb2839d. The patch guarantees forward progress by emitting the first character on its own line when no break point fits within opts.width.

Detection Methods for CVE-2026-96780

Indicators of Compromise

• Node.js processes pinned at 100% CPU on a single core without corresponding request throughput
• Steadily growing resident memory in processes that invoke figlet rendering
• HTTP request timeouts or dropped connections to endpoints that render ASCII art or banner text
• Application logs showing requests to figlet-backed endpoints with unusually small width values

Detection Strategies

• Audit dependency manifests (package.json, package-lock.json, yarn.lock) for figlet versions below 1.11.3
• Perform static code review of all text() and textSync() call sites to identify where whitespaceBreak and width are user-influenced
• Instrument request handlers that invoke figlet with execution timeouts and log slow invocations

Monitoring Recommendations

• Alert on sustained single-threaded CPU saturation in Node.js workers
• Track event-loop lag metrics and emit warnings when latency exceeds normal baselines
• Monitor web application firewall logs for repeated requests supplying numeric formatting parameters at or near zero

How to Mitigate CVE-2026-96780

Immediate Actions Required

• Upgrade figlet.js to version 1.11.3 or later across all affected projects
• Audit application endpoints that pass user input into figlet rendering functions
• Apply input validation that rejects width values below a safe minimum before invoking figlet

Patch Information

The fix is included in figlet.js version 1.11.3 via commit cb2839d0e53aeafbd361e9587abc72e49e41cbb3 and GitHub Pull Request #169. Full technical details are available in GitHub Security Advisory GHSA-62ch-8vmq-8xm7.

Workarounds

• Disable the whitespaceBreak option in all text() and textSync() invocations until the upgrade is applied
• Enforce a server-side minimum for the width parameter that exceeds the widest glyph in the configured FIGfont
• Wrap figlet calls in a worker thread with a hard execution timeout to prevent event-loop starvation

# Upgrade figlet.js to the patched release
npm install figlet@^1.11.3

# Verify the installed version
npm ls figlet