CVE-2026-96780: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
A denial-of-service (infinite loop) can occur in text() / textSync() when
both:
whitespaceBreak: trueis set, andwidthis set smaller than the rendered width of a single FIGlet character. Under these conditionsbreakWord()could never find a valid break point, so the word-wrapping loop ingenerateFigTextLines()never terminated. This pins a CPU core and grows memory without bound, blocking the Node.js event loop.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-96780 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →