CVE-2026-96780: figlet is vulnerable to denial of service via unbounded loop when whitespaceBreak is used with a small width
A denial-of-service (infinite loop) can occur in text() / textSync() when
both:
whitespaceBreak: trueis set, andwidthis set smaller than the rendered width of a single FIGlet character. Under these conditionsbreakWord()could never find a valid break point, so the word-wrapping loop ingenerateFigTextLines()never terminated. This pins a CPU core and grows memory without bound, blocking the Node.js event loop.
References
Code Behaviors & Features
Detect and mitigate CVE-2026-96780 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →