CVE-2026-96780

### Impact A denial-of-service (infinite loop) can occur in `text()` / `textSync()` when **both**: - `whitespaceBreak: true` is set, **and** - `width` is set smaller than the rendered width of a single FIGlet character. Under these conditions `breakWord()` could never find a valid break point, so the word-wrapping loop in `generateFigTextLines()` never terminated. This pins a CPU core and grows memory without bound, blocking the Node.js event loop. ### Severity Low or Medium. Triggering requires a non-default configuration (`whitespaceBreak: true`) and an attacker-controlled `width` value reaching `text()`/`textSync()`. This library is typically used with fixed options, where this is not reachable. Applications that pass an untrusted `width` together with `whitespaceBreak` on a request path are affected. ### Patches Fixed in **figlet 1.11.3**. `breakWord()` now always makes forward progress (emitting an over-wide character on its own line), and FIGlet header parsing now rejects invalid values (e.g. zero/negative height). ### Workarounds Do not expose `width` to untrusted input, or leave `whitespaceBreak` disabled (the default), or upgrade to 1.11.3.