CyberRota Analysis
AI-GeneratedThe figlet.js library in JavaScript is vulnerable to a denial-of-service condition due to an unbounded loop in the text() and textSync() functions when specific conditions are met, such as enabling whitespaceBreak with a width smaller than the rendered width of a FIGlet character. This flaw can lead to excessive CPU consumption and memory growth, potentially impacting application performance. Organizations using affected versions of figlet.js should prioritize upgrading to version 1.11.3 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
figlet.js is a FIG driver written in JavaScript that aims to implement the FIGfont specification. Prior to 1.11.3, text() and textSync() can enter an unbounded loop when whitespaceBreak is enabled and width is smaller than the rendered width of a single FIGlet character. Under these conditions, breakWord() cannot find a valid break point and returns without consuming a character, so generateFigTextLines() repeatedly processes the same input while consuming CPU and growing memory. The non-default option and attacker-controlled width must both reach an affected call. This issue is fixed in version 1.11.3.