EUVD-2026-86327Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Habitica API
-
DeliveryCall /groups/:groupId/members with malicious regex in search param
-
ExploitUnsanitized input compiled via new RegExp
-
ExecutionCatastrophic backtracking pins event loop
-
ImpactNode.js process stalls, denial of service
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Habitica account (PR:L) able to call GET /api/v3/groups/:groupId/members; exploitation is possible against default configurations of affected versions 4.172.1 through 5.48.1 because the |
| Impact | This is a CWE-1333 Regular Expression Denial of Service (ReDoS) in Habitica's member-search route. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is credible and self-consistent: network-reachable, low complexity, requires an authenticated account (PR:L), no user interaction, and impact is purely availability (A:H) with no confidentiality or integrity effect - matching a DoS. Because Node.js executes JavaScript on a single event-loop thread, a catastrophically-backtracking regex passed to |
| Exploit ScenarioDerived | An attacker registers or uses any authenticated Habitica account and calls GET /api/v3/groups/:groupId/members with a |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 24, 2026
A regular expression denial of service in Habitica's group member-search endpoint allows an authenticated user to send a crafted search query parameter to GET /api/v3/groups/:groupId/members that is compiled directly into a JavaScript RegExp, causing catastrophic backtracking that degrades application response times or halts Node.js worker processes. The flaw affects Habitica versions 4.172.1 through 5.48.1 in default configurations; both self-hosted instances and the shared hosted service are exposed, with the hosted instance allowing a single account to degrade service for all users. Exploitation requires only a valid account and membership in a group (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5), and no public exploit code was identified at time of analysis. The issue is fixed in version 5.48.2.
RemediationAI
Vendor-released patch: upgrade to Habitica 5.48.2 (https://github.com/HabitRPG/habitica/releases/tag/v5.48.2), which incorporates the upstream fix 7b7dc255dff1564935675399ff168e8a91b8afca escaping the search parameter before RegExp construction; the vendor advisory is at https://github.com/HabitRPG/habitica/security/advisories/GHSA-x772-22c9-gq58. If immediate upgrade is not possible, apply the same escaping logic by hand - replace new RegExp(req.query.search, 'i') with new RegExp(escapedSearch, 'i') using a library such as escape-string-regexp, or drop $regex entirely in favor of an anchored, escaped prefix match; note that hand-patching server source diverges from the vendor branch and must be reverted when upgrading. Additional compensating controls with trade-offs: enforce a maximum length and character whitelist on the search query parameter at the reverse proxy or application middleware layer (blocks nested-quantifier payloads but rejects legitimate searches containing special characters); rate-limit or temporarily block /api/v3/groups/:groupId/members per account (reduces blast radius but degrades a normal feature and is ineffective against a single slow request); run the Node.js process with a supervisor that restarts on hang and front it with a request timeout (recovers availability but does not prevent the blocking event loop or in-flight user impact); and note that generic WAF regex-inspection rules are prone to false positives on this endpoint and should be tested before enforcement. Because exploitation is authenticated, invalidating sessions of untrusted or automated accounts on the shared instance provides only marginal protection and is not a substitute for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-1333 (Inefficient Regular Expression Complexity, commonly called ReDoS). Habitica's members controller built a MongoDB query of the form { 'auth.local.username': { $regex: new RegExp(req.query.search, 'i') } }, meaning the attacker-controlled search query string was passed to the JavaScript RegExp constructor without escaping or length/complexity validation. Because user-supplied text becomes the regex pattern itself rather than a literal match value (as it would with the MongoDB $regex string operator plus $options, or after escaping metacharacters), an attacker can submit nested quantifiers such as (a+)+$ that trigger exponential backtracking against non-matching input, blocking Node.js's single-threaded event loop. The upstream fix in commit 7b7dc255dff1564935675399ff168e8a91b8afca replaces new RegExp(req.query.search, 'i') with new RegExp(escapedSearch, 'i'), escaping regex metacharacters so the parameter is treated as a literal substring search. Node.js has no built-in regex timeout, so the affected runtime cannot interrupt a runaway match; the technology stack is a Node.js backend with MongoDB regex-based querying, and the CPE cpe:2.3:a:habitrpg:habitica:*:*:*:*:*:*:*:* indicates the whole product line is the affected component.
Know when Habitica gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable authenticated endpoint (PR:L, AC:L), single-threaded Node.js event loop makes one crafted regex halt the whole process (A:H); no confidentiality or integrity impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
1DescriptionCVE.org
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.
Threat Intelligence Overview
NVD
CVE.org
EPSS
GitHub
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
In habitica versions v4.119.0 through v4.232.2 are vulnerable to DOM XSS via the login page. Rated medium severity (CVSS
In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page. Rated medium severity
Habitica is an open-source habit-building program. Rated medium severity (CVSS 5.0), this vulnerability is remotely expl
Habitica is an open-source habit-building program. Rated medium severity (CVSS 5.0), this vulnerability is remotely expl
Habitica is an open-source habit-building program. Rated low severity (CVSS 2.0), this vulnerability is remotely exploit
Exploit-DB