### Impact
A denial-of-service (infinite loop) can occur in `text()` / `textSync()` when
**both**:
- `whitespaceBreak: true` is set, **and**
- `width` is set smaller than the rendered width of a single FIGlet character.
Under these conditions `breakWord()` could never find a valid break point, so the
word-wrapping loop in `generateFigTextLines()` never terminated. This pins a CPU
core and grows memory without bound, blocking the Node.js event loop.

### Severity
Low or Medium. Triggering requires a non-default configuration (`whitespaceBreak: true`) and
an attacker-controlled `width` value reaching `text()`/`textSync()`. This library is typically
used with fixed options, where this is not
reachable. Applications that pass an untrusted `width` together with
`whitespaceBreak` on a request path are affected.

### Patches
Fixed in **figlet 1.11.3**. `breakWord()` now always makes forward progress
(emitting an over-wide character on its own line), and FIGlet header parsing now
rejects invalid values (e.g. zero/negative height).

### Workarounds
Do not expose `width` to untrusted input, or leave `whitespaceBreak` disabled
(the default), or upgrade to 1.11.3.