CVE-2026-54461

Executive Summary

CVE-2026-54461 is a regular expression denial of service (ReDoS) vulnerability affecting Habitica, a habit-tracking application styled as a role-playing game, in versions from 4.172.1 until 5.48.2. A query parameter on the /api/v3/groups/:groupId/members route is not sanitized before being interpreted as a regular expression, allowing an authenticated caller to supply a computationally expensive pattern that degrades application performance or halts Node.js processes. Successful exploitation results in a high availability impact, though confidentiality and integrity are unaffected; the issue is resolved in version 5.48.2.

Technical Analysis

The vulnerability class is CWE-1333, Inefficient Regular Expression Complexity, commonly referred to as ReDoS. The root cause is that a query parameter accepted by the /api/v3/groups/:groupId/members endpoint is passed into a regular expression engine without sanitization or complexity bounding. Because the value is interpreted as a regular expression rather than treated as an opaque search/filter string, an attacker can control the structure of the pattern being evaluated.

ReDoS arises when a regular expression contains ambiguous or nested quantifiers that permit catastrophic backtracking. When such a pattern is matched against a crafted or adversarial input string, the regex engine explores an exponential number of possible match partitions, consuming CPU time disproportionate to input length. The NVD description does not disclose the exact parameter name, the specific pattern, or the matching input controlled by the caller, so the precise backtracking construct cannot be stated here without fabrication. What is confirmed is the mechanism: attacker-controlled input reaches a regex interpreter on a Node.js backend.

Habitica is implemented on Node.js, which executes JavaScript on a single-threaded event loop. This architectural characteristic magnifies impact. A catastrophic backtracking match is a synchronous, CPU-bound operation that occupies the event loop thread for the duration of the match attempt. While the thread is blocked, the process cannot service other requests, so the degradation is not confined to the single requesting user—it stalls concurrent traffic handled by that process. The NVD description explicitly notes that exploitation "degrades application performance or halts Node.js processes," consistent with event-loop starvation and potential process termination.

The attack surface is the group members listing functionality. The route /api/v3/groups/:groupId/members returns membership data for a group identified by groupId. The vulnerable query parameter is a filter/search-style input used to narrow or match members. Because the route is authenticated (PR:L in the CVSS vector indicates low privileges required), an attacker must hold a valid Habitica account and authenticate to the API. No user interaction is required (UI:N), and the attack is network-reachable (AV:N). The scope is unchanged (S:U), meaning the impact remains within the vulnerable component's security authority.

Affected versions span 4.172.1 through 5.48.1. The fix lands in 5.48.2. Patch confidence is 0/4 because no patch evidence was available from tracked sources at the time of writing; however, the NVD description designates 5.48.2 as the fixed version, which is the authoritative remediation target.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-54461. The following attack chain is inferred strictly from the vulnerability class (ReDoS via unsanitized regex query parameter) and is described at the class level without inventing parameter names, payloads, or code specifics not present in the source data.

1. Reconnaissance and target identification. The attacker identifies an internet-exposed or internal Habitica deployment running a version in the range 4.172.1 to 5.48.1. This is a self-hostable open-source application, so victims may include organizations running private instances as well as users of the hosted service. The attacker confirms the API is reachable and that the /api/v3/groups/:groupId/members route is accessible, then registers or obtains a low-privilege authenticated account, since authentication is required to reach the endpoint.

2. Triggering the flaw. Using an authenticated session, the attacker issues requests to /api/v3/groups/:groupId/members while supplying a query parameter whose value is structured as a catastrophic-backtracking regular expression. Because the value is interpreted directly as a regex, the engine attempts to evaluate the attacker-controlled pattern against member data or the supplied match input. The attacker tunes the pattern to maximize backtracking cost against the input the application matches it to—without knowing internal specifics, the general approach for this class is to use nested or ambiguous quantifiers that produce exponential match-space exploration.

3. Execution method. The trigger is a single crafted HTTP request (or a small number of them) carrying the malicious pattern. It is a low-volume, low-bandwidth attack: the payload is a short string, so traditional volumetric defenses are ineffective. Because Node.js is single-threaded per process, each expensive match pins an event-loop thread; repeated or concurrent requests can saturate the available process pool.

4. Post-exploitation impact. The immediate effect is availability loss: elevated CPU consumption, response-time degradation, request timeouts, and—per the NVD description—potential halting of Node.js worker processes. This can render the group members feature, and by extension the affected server process, unresponsive to legitimate users. There is no confidentiality or integrity impact described; the attacker does not exfiltrate data or modify state. Sustained exploitation could constitute a denial-of-service condition against the application, requiring process restart or autoscaling to recover. Exploitation requires valid low-privilege credentials, which lowers the barrier compared to fully unauthenticated attacks but still gates the attack behind account creation or compromise.

Impact Assessment

The CVSS v3.1 base score is 6.5 (Medium), with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. Breaking this down:

• Attack Vector (AV:N): The endpoint is reachable over the network, so remote attackers can exploit it without local access.
• Attack Complexity (AC:L): No specialized conditions beyond crafting a regex are required; the attack does not depend on race conditions or hard-to-reach states.
• Privileges Required (PR:L): The attacker must be authenticated with a low-privilege account. This is the primary mitigating factor lowering the base score.
• User Interaction (UI:N): No victim action is needed to trigger the flaw.
• Scope (S:U): Impact is confined to the vulnerable component.
• Confidentiality (C:N) / Integrity (I:N): No data disclosure or tampering is described.
• Availability (A:H): The dominant impact. Exploitation degrades or halts Node.js processes, producing a high availability loss.

Business impact centers on service availability of the Habitica API and web application. For the hosted service, this translates to degraded responsiveness and potential outages for legitimate users during active exploitation. For organizations self-hosting Habitica, an authenticated internal or external user could stall shared Node.js processes, disrupting a team's productivity tooling. Blast radius is bounded by the deployment's process architecture: a single blocked event loop affects all concurrent requests handled by that process, and concurrent exploitation can exhaust the process pool, but the flaw does not cross a scope boundary or enable lateral movement. The EPSS score has not yet been assigned by FIRST.org, so no probability estimate is available. The vulnerability is not listed in CISA KEV, and no exploit code or Nuclei template is known, indicating no confirmed in-the-wild exploitation at the time of writing.

Detection Guidance

Sigma Rule

title: Habitica ReDoS Attempt via Group Members Regex Query Parameter
id: 9f3c1a72-5b64-4e0d-9d21-7a1e8c4b2f10
status: experimental
description: Detects requests to the Habitica group members endpoint carrying regex metacharacters indicative of a regular expression denial of service (ReDoS) attempt (CVE-2026-54461).
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-54461
author: Threat Intelligence
date: 2026/01/01
logsource:
  category: webserver
detection:
  selection_endpoint:
    cs-uri-stem|contains: '/api/v3/groups/'
  selection_path:
    cs-uri-stem|endswith: '/members'
  selection_regex_meta:
    cs-uri-query|contains:
      - '(a+)+'
      - '(a*)*'
      - '(.+)+'
      - '([a-z]+)+'
      - '(.*)*'
      - '(a|a)+'
      - '(\\w+)+'
  condition: selection_endpoint and selection_path and selection_regex_meta
fields:
  - c-ip
  - cs-uri-query
  - cs-uri-stem
falsepositives:
  - Legitimate search filters that happen to contain nested quantifiers
level: medium
tags:
  - attack.t1499
  - cve.2026.54461

YARA Rule

rule CVE_2026_54461_Habitica_ReDoS_Pattern
{
    meta:
        description = "Detects catastrophic backtracking regular expression patterns in HTTP request material targeting Habitica group members endpoint (CVE-2026-54461)"
        author = "Threat Intelligence"
        date = "2026-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-54461"
        cve = "CVE-2026-54461"

    strings:
        $endpoint = "/api/v3/groups/" ascii wide nocase
        $members  = "/members" ascii wide nocase
        $q1 = "(a+)+" ascii
        $q2 = "(a*)*" ascii
        $q3 = "(.+)+" ascii
        $q4 = "([a-z]+)+" ascii
        $q5 = "(.*)*" ascii
        $q6 = "(\\w+)+" ascii
        $q7 = ")?+" ascii

    condition:
        $endpoint and $members and 1 of ($q*)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-54461 Habitica ReDoS Attempt via Group Members Regex Parameter"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/api/v3/groups/"; http.uri; content:"/members"; http.uri; pcre:"/(\([^)]*[\+\*]\)[\+\*])|(\(\.\*\)[\+\*])|(\(\\w\+\)\+)/i"; classtype:attempted-dos; reference:cve,2026-54461; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-54461; sid:202654461; rev:1; metadata:affected_product Habitica, attack_target Web_Server, deployment Perimeter, signature_severity Major, created_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=10s
  [http where http.request.method == "GET"
    and http.request.uri : "/api/v3/groups/*"
    and http.request.uri : "*/members*"
    and http.request.uri : ("*(a+)+*" or "*(a*)**" or "*(.+)+*" or "*(.*)* *" or "*(\\w+)+ *")]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=nginx:plus:access
| eval uri=coalesce(uri, cs_uri_stem, request)
| eval raw_query=coalesce(uri_query, cs_uri_query, query)
| where match(uri, "/api/v3/groups/.*/members")
| where (like(raw_query, "%(a+)+%") OR like(raw_query, "%(a*)*%") OR like(raw_query, "%(.+)+%") OR like(raw_query, "%(.*)*%") OR like(raw_query, "%([a-z]+)+%") OR like(raw_query, "%(\\w+)+%"))
| stats count min(_time) as first_seen max(_time) as last_seen values(raw_query) as payloads by src_ip, uri
| where count >= 3
| sort - count
| convert ctime(first_seen) ctime(last_seen)

Wazuh OSSEC Rule

<group name="web,habitica,redos,">
  <rule id="202654461" level="10">
    <if_sid>31100</if_sid>
    <field name="url">/api/v3/groups/</field>
    <field name="url">/members</field>
    <regex type="pcre2">\(\S*[\+\*]\)[\+\*]|\(\.\*\)[\+\*]|\(\\w\+\)\+</regex>
    <description>CVE-2026-54461: Possible Habitica ReDoS attempt via regex query parameter on /api/v3/groups/:groupId/members</description>
    <mitre>
      <id>T1499</id>
    </mitre>
    <group>attack,pci_dss_6.5.1,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). The authoritative remediation target per the NVD description is Habitica version 5.48.2.

1. Immediate mitigations (before upgrade):

• Upgrade to 5.48.2 as the priority action; this is the version identified as containing the fix. Given the low patch confidence score, verify the fixed version against the vendor's release notes directly before relying on it.
• Where upgrade is not immediately possible, restrict network access to the API, especially the /api/v3/groups/:groupId/members route, to trusted networks.
• Apply rate limiting and request throttling at the reverse proxy or API gateway for authenticated users hitting group members endpoints, to reduce the concurrency an attacker can generate against the single-threaded Node.js event loop.
• Enforce per-request CPU/time budgets at the proxy layer (request timeouts) so a single expensive match cannot pin a worker indefinitely; configure process supervisors to restart halted Node.js workers.
• Audit and reduce the privilege surface: because exploitation requires only a low-privilege authenticated account, restrict account-creation or membership-scope access where operationally feasible.

2. Patch/upgrade steps:

• Identify all Habitica deployments, including self-hosted instances, and confirm current version.
• Back up configuration and data, then upgrade Habitica to 5.48.2.
• Restart Node.js processes and validate that the /api/v3/groups/:groupId/members route no longer interprets unsanitized input as a regular expression.

3. Long-term hardening:

• Eliminate user-supplied regular expressions in query-parameter handling; replace regex-based filtering with literal, escaped matching or precompiled, non-user-controlled patterns.
• Introduce a safe-regex validation layer and execution time limits for any code path where regex is unavoidable.
• Adopt a regex static-analysis linter (e.g., detecting nested quantifiers) into CI/CD to prevent reintroduction of ReDoS-prone patterns.
• Implement defense-in-depth resource governance: worker process isolation, event-loop monitoring, CPU-based autoscaling, and health checks that detect event-loop blocking.

References

• NVD — CVE-2026-54461: https://nvd.nist.gov/vuln/detail/CVE-2026-54461
• MITRE CWE-1333 — Inefficient Regular Expression Complexity: https://cwe.mitre.org/data/definitions/1333.html
• Habitica project (upstream repository and release notes for version 5.48.2): https://github.com/HabitRPG/habitica
• MITRE ATT&CK T1499 — Endpoint Denial of Service: https://attack.mitre.org/techniques/T1499/
• OWASP — Regular Expression Denial of Service (ReDoS): https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS

No threat actor campaigns or exploit-in-the-wild evidence are associated with CVE-2026-54461 at the time of writing. No public proof-of-concept, exploit code, or Nuclei template is known, and the vulnerability is not listed in CISA KEV. EPSS has not yet been scored by FIRST.org.