The vulnerability is an unbounded loop that arises when figlet.js processes text with whitespaceBreak enabled and a width setting smaller than the width of a single constructed FIGlet character. In this scenario, breakWord cannot locate a valid break point and returns without consuming a character. As a result, generateFigTextLines repeatedly processes the same input, causing continuous CPU consumption and uncontrolled memory growth. The consequence is denial of service by exhausting system resources.

The affected product is figlet.js, a project maintained by patorjk. Any installation of figlet.js older than version 1.11.3 is vulnerable. The vulnerability manifests when the library is invoked via the text() or textSync() functions with the whitespaceBreak option enabled and a width value smaller than the rendered FIGlet character width.

The CVSS score of 8.2 marks this vulnerability as high severity. The EPSS score is not available, and it is not listed in the CISA KEV catalog, so there is no known widespread exploitation. The likely attack vector requires the attacker to control the width parameter and enable whitespaceBreak in an environment that processes untrusted input through figlet.js. Successful exploitation would lead to resource exhaustion and potential service disruption in the affected application or system.