Skip to content
Section C · The archive · Dispatch
← The archive

vulnerability · Fri 02 Oct 2026 · 22:39 UTC

GHSA-62ch-8vmq-8xm7: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width

Filed UTCSource GTH ↗

A denial-of-service (infinite loop) can occur in text() / textSync() when both: - whitespaceBreak: true is set, and - width is set smaller than the rendered width of a single FIGlet character. Under these conditions breakWord() could never find a valid break point, so the word-wrapping loop in generateFigTextLines() never terminated. This pins a CPU core and grows memory without bound, blocking the Node.js event loop. ### Severity Low or Medium. …

Signals

as the pipeline stamped them
High
High-risk vulnerability

CVE

KEV from CISA · EPSS from FIRST
CVE ids in this dispatch with their KEV status and EPSS score
IdKEVEPSSReference
CVE-2026-96780—0.40%NVD ↗

Get the next one first.

Every dispatch goes to Telegram and RSS the moment it is published, and the whole wire is a keyless JSON API.

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.