CVE-2026-54461

Deferred Deferred - Pending Action

Regular Expression Denial of Service in Habitica

Publication date: 2026-09-24

Last updated on: 2026-09-30

Assigner: GitHub, Inc.

Description

Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-30

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-54461

EUVD

EUVD-2026-86327

Affected Vendors & Products

Vendor	Product	Version / Range
habitica	habitica	From 4.172.1 (inc) to 5.48.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

Attack-Flow Graph

Executive Summary

This is a Regex Injection or ReDoS vulnerability in Habitica affecting versions 4.172.1 through 5.48.1. An unauthenticated query parameter in the /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. Attackers can exploit this by submitting a computationally expensive regex to degrade performance or crash Node.js processes.

Detection Guidance

To detect this vulnerability, monitor for unusual CPU usage spikes on your Habitica server, particularly when processing requests to the /api/v3/groups/:groupId/members endpoint. Check logs for requests containing complex regex patterns in query parameters. Use tools like netstat or ss to inspect active connections to the Habitica service.

Impact Analysis

If exploited, this vulnerability can cause significant performance degradation or complete denial of service for the Habitica application. This may lead to downtime, disrupted user experience, and potential loss of access to the service for legitimate users.

Compliance Impact

This vulnerability primarily impacts system availability due to potential denial-of-service conditions caused by regex-based attacks. While it does not directly expose or leak data, degraded performance or system unavailability could indirectly affect compliance with standards requiring consistent data access or processing capabilities, such as GDPR's availability principle or HIPAA's access controls. However, the CVE does not provide specific compliance implications.

Mitigation Strategies

Immediately upgrade Habitica to version 5.48.2 or later to patch the vulnerability. If upgrading is not possible, restrict access to the /api/v3/groups/:groupId/members endpoint by implementing network-level controls or rate limiting. Monitor server performance closely for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-54461. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70