CVE-2026-54461 describes an inefficient regular expression complexity vulnerability (CWE-1333) in Habitica, a habit tracking application. The vulnerability exists in versions >=4.172.1 and <5.48.2, where a query parameter on the /api/v3/groups/:groupId/members API endpoint is interpreted as a regular expression without proper sanitization. An authenticated attacker can supply a crafted regular expression that is computationally expensive, leading to denial of service by degrading application performance or halting the Node.js processes running the application. The vulnerability has a CVSS 3.1 base score of 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. The issue is resolved in version 5.48.2.

Exploitation of this vulnerability can cause denial of service conditions by significantly degrading application performance or causing the Node.js process to halt. There is no impact on confidentiality or integrity, only availability is affected. The attacker must be authenticated to exploit this issue.

Upgrade Habitica to version 5.48.2 or later, where this vulnerability is fixed. No other mitigations are indicated or required according to the available data.