Read the docs
TI-2026-33362 Aliases CVE-2026-45617GHSA-r7g9-xpmj-5fcq

LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

Priority HIGH 72CWE-1333Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-1333.

Summary

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many <script, <style, or <!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking the Node.js event loop. A single ~350 KB request ('<script'.repeat(50000)) stalls the process for ~10 seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs unbounded. A single unauthenticated request containing crafted untrusted input can cause severe event-loop blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections. This issue has been fixed in version 10.26.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00458 39th percentileScored 2026-11-07
Fix Fixed liquidjs (harttle): 10.26.0liquidjs (npm): 10.26.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
harttleliquidjsbefore 10.26.010.26.0Patch availableCNA
—liquidjs (npm)before 10.26.010.26.0Patch availableGHSA-r7g9-xpmj-5fcq
  • liquidjs Vendorharttle Affected before 10.26.0 Fixed in 10.26.0 Patch available CNA
  • liquidjs (npm) Vendor— Affected before 10.26.0 Fixed in 10.26.0 Patch available GHSA-r7g9-xpmj-5fcq

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:*——harttle
  • cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:* Versions — — ·harttle

Remediation

  • Fix · CNA liquidjs (harttle) Fixed in 10.26.0
  • Fix · GHSA-r7g9-xpmj-5fcq liquidjs (npm) Fixed in 10.26.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-45617
  2. 2026-10-03 Alias added: GHSA-r7g9-xpmj-5fcq
  3. 2026-10-13 EPSS moved to the 50th–90th percentile
  4. 2026-10-25 EPSS moved to the below the 50th percentile

References

Advisory 1

Other 4

  • TI-2026-33363 LiquidJS is Vulnerable to Remote Code Execution CVSS 3.1CRITICAL 10.0
  • TI-2026-44110 LiquidJS: An infinite loop vulnerability in `strip_html` filter CVSS 4.0HIGH 8.7
  • TI-2026-40114 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CVSS 4.0HIGH 8.2
  • TI-2026-29912 LiquidJS is vulnerable to Denial of Service via circular block reference in layout CVSS 3.1HIGH 7.5
  • TI-2026-28394 Information disclosure in harttle liquidjs CVSS 3.1HIGH 7.5
  • TI-2026-25698 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern CVSS 3.1HIGH 7.5
See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences