CVE-2026-54461 — Habitica: Regex Injection / ReDoS in Member Search
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members ro…
Published: 2026-09-24 · CVSS: 6.5 · CVSS 3.1
Habitica is a habit tracker application that treats goals like a role-playing game. From 4.172.1 until 5.48.2, a query parameter on Habitica's /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression. An authenticated caller can supply a computationally expensive regular expression that degrades application performance or halts Node.js processes. This issue is fixed in version 5.48.2.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7