CVE-2026-96780 figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
An attacker can cause a denial of service in figlet.js by triggering an unbounded loop when whitespaceBreak is enabled with a small width.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-96780?
CVE-2026-96780 is a high-severity denial of service vulnerability in patorjk figlet.js, published on 1 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.
Weakness: CWE-835
Which versions are affected by CVE-2026-96780?
2 open source packages ship an affected version, including figlet.
| Package | Affected | Fixed in |
|---|---|---|
figlet npm | All versions | 1.11.3 |
figlet npm | All versions | 1.11.3 |
How do I fix CVE-2026-96780?
Upgrade figlet to 1.11.3 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-96780 being exploited?
There is no known exploitation of CVE-2026-96780 in the wild and no public exploit code.
Sources
Also known as CLSA-2026-1791051095, GHSA-62ch-8vmq-8xm7.