Read the docs
TI-2026-33148 Aliases CVE-2026-45357GHSA-hh27-hf48-9f5q

LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00385 32nd percentileScored 2026-11-07
Fix Fixed liquidjs (harttle): 10.26.0liquidjs (npm): 10.26.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
harttleliquidjsbefore 10.26.010.26.0Patch availableCNA
—liquidjs (npm)before 10.26.010.26.0Patch availableGHSA-hh27-hf48-9f5q
  • liquidjs Vendorharttle Affected before 10.26.0 Fixed in 10.26.0 Patch available CNA
  • liquidjs (npm) Vendor— Affected before 10.26.0 Fixed in 10.26.0 Patch available GHSA-hh27-hf48-9f5q

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:*——harttle
  • cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:* Versions — — ·harttle

Remediation

  • Fix · CNA liquidjs (harttle) Fixed in 10.26.0
  • Fix · GHSA-hh27-hf48-9f5q liquidjs (npm) Fixed in 10.26.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45357
  2. 2026-10-03 Alias added: GHSA-hh27-hf48-9f5q
  3. 2026-10-13 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile
  5. 2026-10-25 Priority changed: MEDIUM → LOW
  6. 2026-10-28 Fix available: npm/[email protected] · GHSA-hh27-hf48-9f5q
  7. 2026-10-28 1 new reference · GHSA-hh27-hf48-9f5q

References

Advisory 1

Other 5

  • TI-2026-33363 LiquidJS is Vulnerable to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-44110 LiquidJS: An infinite loop vulnerability in `strip_html` filter CVSS 4.0HIGH 8.7
  • TI-2026-40114 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CVSS 4.0HIGH 8.2
  • TI-2026-33362 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex CVSS 3.1HIGH 7.5
  • TI-2026-29912 LiquidJS is vulnerable to Denial of Service via circular block reference in layout CVSS 3.1HIGH 7.5
  • TI-2026-28394 Information disclosure in harttle liquidjs CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences