Habitica’s /api/v3/groups/:groupId/members endpoint does not sanitize a query parameter before interpreting it as a regular expression, allowing an authenticated caller to send an expensive expression that consumes excessive CPU or memory. The resulting slowdown can degrade overall application performance or terminate Node.js processes, effectively denying service to all users of the affected group.

Version 4.172.1 through 5.48.2 of HabitRPG’s Habitica contains the flaw. Any authenticated user who can query the member list of a group can trigger the issue via the /api/v3/groups/:groupId/members route. The fix was released with version 5.48.2.

The CVSS score of 6.5 classifies the vulnerability as moderate severity; EPSS data is not available, and the flaw is not listed in CISA KEV. Because the attack requires authentication, the likelihood of exploitation depends on the presence of privileged accounts or compromised credentials. A successful attack would cause a denial of service by exhausting node resources or halting the process, impacting all users of the affected application.