Figlet Js
Monthly
Unbounded CPU and memory consumption in figlet.js versions prior to 1.11.3 allows remote, unauthenticated attackers to exhaust server resources by driving text() or textSync() into a non-terminating loop. Exploitation requires two conditions in the consuming application: the non-default whitespaceBreak option must be enabled, and the attacker must control or influence the width parameter and set it narrower than the rendered width of a single FIGlet character - the root cause is CWE-835, where breakWord() cannot find a valid break point, returns without consuming any character, and generateFigTextLines() reprocesses the same input indefinitely. Impact is availability-only (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.2 with VA:H and VC/VI:N), with no code execution, file access, or data exposure; exploitability is limited because whitespaceBreak is off by default and width is often hardcoded server-side. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (no CISA KEV listing).
Unbounded CPU and memory consumption in figlet.js versions prior to 1.11.3 allows remote, unauthenticated attackers to exhaust server resources by driving text() or textSync() into a non-terminating loop. Exploitation requires two conditions in the consuming application: the non-default whitespaceBreak option must be enabled, and the attacker must control or influence the width parameter and set it narrower than the rendered width of a single FIGlet character - the root cause is CWE-835, where breakWord() cannot find a valid break point, returns without consuming any character, and generateFigTextLines() reprocesses the same input indefinitely. Impact is availability-only (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H; vendor CVSS 4.0 base 8.2 with VA:H and VC/VI:N), with no code execution, file access, or data exposure; exploitability is limited because whitespaceBreak is off by default and width is often hardcoded server-side. No public exploit code has been identified at time of analysis, and there is no evidence of active exploitation (no CISA KEV listing).