CVE-2026-96780: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in patorjk figlet.js
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.
AI Analysis
Technical Summary
CVE-2026-96780 is an infinite loop vulnerability in figlet.js, a JavaScript FIGfont driver. When the non-default option whitespaceBreak is enabled and the width parameter is smaller than the rendered width of a single FIGlet character, breakWord() cannot find a valid break point and returns without consuming input. This causes generateFigTextLines() to repeatedly process the same input, resulting in unbounded CPU and memory consumption. The vulnerability affects all versions prior to 1.11.3 and requires both the attacker-controlled width and the whitespaceBreak option to be set to trigger the issue. The vulnerability has a CVSS 4.0 score of 8.2 (high severity) and is fixed in version 1.11.3.
Potential Impact
An attacker can cause figlet.js to enter an infinite loop, leading to high CPU utilization and increased memory consumption. This can degrade application performance or cause denial of service conditions. Exploitation requires control over the width parameter and enabling the whitespaceBreak option, which is not enabled by default.
Mitigation Recommendations
Upgrade figlet.js to version 1.11.3 or later, where this infinite loop vulnerability is fixed. If upgrading is not immediately possible, avoid enabling the whitespaceBreak option or ensure that the width parameter is not set smaller than the width of a single FIGlet character to prevent triggering the issue.
CVE-2026-96780: CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop') in patorjk figlet.js
Description
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.
CVSS v4.0
Score 8.2high
Affected software
patorjk
figlet.js
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-96780 is an infinite loop vulnerability in figlet.js, a JavaScript FIGfont driver. When the non-default option whitespaceBreak is enabled and the width parameter is smaller than the rendered width of a single FIGlet character, breakWord() cannot find a valid break point and returns without consuming input. This causes generateFigTextLines() to repeatedly process the same input, resulting in unbounded CPU and memory consumption. The vulnerability affects all versions prior to 1.11.3 and requires both the attacker-controlled width and the whitespaceBreak option to be set to trigger the issue. The vulnerability has a CVSS 4.0 score of 8.2 (high severity) and is fixed in version 1.11.3.
Potential Impact
An attacker can cause figlet.js to enter an infinite loop, leading to high CPU utilization and increased memory consumption. This can degrade application performance or cause denial of service conditions. Exploitation requires control over the width parameter and enabling the whitespaceBreak option, which is not enabled by default.
Mitigation Recommendations
Upgrade figlet.js to version 1.11.3 or later, where this infinite loop vulnerability is fixed. If upgrading is not immediately possible, avoid enabling the whitespaceBreak option or ensure that the width parameter is not set smaller than the width of a single FIGlet character to prevent triggering the issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-23T16:25:20.414Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6abec6cda43b0b3b89fd0066
Added to database: 10/01/2026, 20:47:09 UTC
Last enriched: 10/01/2026, 21:01:04 UTC
Last updated: 10/01/2026, 21:28:39 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.