Regular Expression Denial of Service in Habitica Habit Tracker

CVE-2026-54461

What is CVE-2026-54461?

The Habitica habit tracker application contains a vulnerability that allows authenticated users to supply a specially crafted query parameter on the /api/v3/groups/:groupId/members route. This parameter is not properly sanitized, enabling the execution of a computationally expensive regular expression. Such an exploit can severely degrade the application performance or potentially halt Node.js processes. This issue affects versions from 4.172.1 through 5.48.2, and users are urged to upgrade to version 5.48.2 or later to mitigate this risk.

References