Executive brief
Pretext is a JavaScript library used for accurate text measurement and layout calculations in web and server applications. A flaw in the text analysis phase causes the library to perform redundant O(n²) work when processing repeated punctuation characters, allowing an attacker to freeze the application's main thread for 20+ seconds with just 80KB of crafted input.
Technical details
The vulnerability exists in the isRepeatedSingleCharRun() function (analysis.ts:285), which re-scans the entire accumulated segment on every merge iteration during text analysis. When buildMergedSegmentation() processes consecutive non-word-like segments containing the same single character (e.g., "(", "[", "!", "#"), it calls isRepeatedSingleCharRun() to verify the match before merging. For a string of N identical punctuation characters, the function performs N full-string scans, resulting in O(n²) total comparisons. An attacker who controls input to prepare() can craft payloads like "(".repeat(80_000) to block the main thread for ~20 seconds. The attack requires no authentication, special encoding, or unusual characters—just repeated ASCII punctuation within normal text input limits. Patches are available in version 0.0.5 via constant-time endpoint checking or metadata tracking, eliminating the quadratic behavior.
Affected products
- chenglou pretext <= 0.0.4
Timeline
- 2026-04-08: disclosed
- 2026-04-08: patched: Fixed in v0.0.5