figlet.js Denial-of-Service Vulnerability Fixed in Version 1.11.3 (CVE-2026-96780)

What happened

A vulnerability (CVE-2026-96780, GHSA-62ch-8vmq-8xm7) was identified in figlet.js, a FIG driver written in JavaScript that implements the FIGlet font specification. The text() and textSync() functions can enter an unbounded loop under specific conditions, causing excessive CPU consumption and memory growth.

Technical cause

The issue occurs when the whitespaceBreak option is enabled and the configured width is smaller than the rendered width of a single FIGlet character. Under these conditions, the internal breakWord() function cannot find a valid break point and returns without consuming a character. As a result, generateFigTextLines() repeatedly processes the same input in a loop that never terminates, consuming CPU and growing memory usage. This is classified as CWE-835, Loop with Unreachable Exit Condition ('Infinite Loop').

Why it matters

Triggering this vulnerability requires both the non-default whitespaceBreak option to be enabled and an attacker-controlled width value to reach an affected call. Where these conditions are met, an application could be made unresponsive or consume excessive resources without requiring authentication or user interaction, which can lead to denial of service for the affected service.

Who is affected

Applications using the figlet npm package that enable the whitespaceBreak option and allow width values derived from attacker-controlled input are affected. Applications that do not use whitespaceBreak, or that do not expose width to untrusted input, are not affected by this specific trigger path.

Affected versions

All versions of figlet prior to 1.11.3 are affected. The issue is fixed in version 1.11.3.

Fixes and mitigation

The vendor has released version 1.11.3 of figlet, which fixes this issue. Users of the figlet npm package should update to version 1.11.3 or later.

Recommended action

Update the figlet package to version 1.11.3 or later. If immediate upgrading is not possible, review whether whitespaceBreak is enabled in your configuration and whether the width parameter can be influenced by untrusted input, and restrict or validate that input as an interim mitigation.