Listen to this Post
CVE-2026-96780 is an infinite loop vulnerability in figlet.js, a JavaScript FIGfont driver. The flaw resides in the text() and textSync() functions, which are responsible for rendering ASCII art text. Under normal operation, these functions wrap text to fit a specified width by breaking lines at whitespace characters. However, the vulnerability is triggered when two specific conditions are met simultaneously: the non-default option whitespaceBreak is enabled, and the width parameter is set to a value smaller than the rendered width of a single FIGlet character. When these conditions are satisfied, the internal breakWord() function fails to find a valid break point. Because it cannot identify where to split the line, it returns without consuming any characters from the input stream. As a result, the parent routine, generateFigTextLines(), enters an unbounded loop. It repeatedly attempts to process the same unprocessed character segment against a width constraint that can never be satisfied by standard whitespace breaks. This cycle consumes CPU cycles continuously and grows memory usage without bound due to the accumulation of intermediate rendering data structures. The vulnerability requires that an attacker controls both the input text and the width parameter passed to the rendering functions. This configuration is not enabled by default, which limits the scope of exploitation. The issue is classified as CWE-835: Loop with Unreachable Exit Condition (Infinite Loop) and CWE-400: Resource Exhaustion. It aligns with ATT&CK technique T1496, Resource Hijacking, specifically resource exhaustion via application logic flaws. The impact is primarily availability-related, causing service degradation or complete unresponsiveness. This issue is fixed in version 1.11.3, where breakWord() now always makes forward progress by emitting an over-wide character on its own line.
DailyCVE Form:
Platform: figlet.js
Version: < 1.11.3
Vulnerability: Infinite loop
Severity: High
date: 2026-10-01
Prediction: 2026-10-01
What Undercode Say:
Analytics:
- Bash command: `npm list figlet`
– Code: `figlet.textSync(‘test’, { width: 1, whitespaceBreak: true })`
Exploit: (Educational Purposes!)
- Concept: Attacker sends request with small width and whitespaceBreak enabled.
- Impact: CPU core pinned, memory growth, event loop blocked.
Protection: from this CVE
- Upgrade to figlet 1.11.3.
- Disable whitespaceBreak.
- Validate width parameter.
Impact:
- Denial of service.
- Resource exhaustion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
