figlet.js EUVD-2026-91058

Two concrete prerequisites must both be met in the consuming application: (1) the non-default whitespaceBreak option must be explicitly enabled on the text()/textSync() call, and (2) an attacker must control (or influence) the width parameter and set it smaller than the rendered width of a single FIGlet character in the chosen font. Exploitation is LIMITED by the fact that whitespaceBreak is off by default and width is frequently a fixed server-side constant; applications that hardcode width or never enable whitespaceBreak are not exploitable. No authentication or user interaction is required by the library itself (PR:N/UI:N), but the AT:P metric reflects this required configuration/input condition.

This is a CWE-835 uncontrolled-loop denial-of-service flaw in figlet.js with a vendor CVSS 4.0 base score of 8.2 (AV:N/AC:L/AT:P/PR:N/UI:N) whose only impact is availability (VA:H); confidentiality and integrity are explicitly N, so there is no code execution or data exposure. The headline 8.2 overstates real-world priority because the AT:P (attack requirements present) metric and the description both make clear exploitation is conditional: the non-default whitespaceBreak option must be enabled AND an attacker-controlled width smaller than a single FIGlet character's rendered width must both reach the vulnerable text()/textSync() call. No EPSS score, SSVC decision, KEV listing, or POC was provided in the input - there is no public exploit identified at time of analysis and no evidence of active exploitation. Signals are internally consistent (network DoS gated by a specific configuration), so this is a genuine but situational availability issue rather than a broadly exploitable critical: realistic risk is limited to services that expose figlet rendering with attacker-influenced width and whitespaceBreak turned on. Patch is confirmed available (v1.11.3), lowering residual risk for maintained deployments.

A web service or API that renders user-supplied text with figlet.js enables the non-default whitespaceBreak option and passes an attacker-controlled width value. The attacker submits a request specifying width=1 (smaller than any single character), causing breakWord() to never find a valid break point so generateFigTextLines() loops indefinitely, pinning CPU and growing memory until the Node.js process is exhausted. No public exploit code was identified, but the fix PR includes trivial reproducer test cases (e.g. text('AB', {width:1, whitespaceBreak:true})).