TI-2026-48565 Aliases CVE-2026-69222 GHSA-4r6h-5v86-94p3

Uncontrolled resource consumption in harttle liquidjs

MEDIUM 40CWE-400Published 2026-08-19 · Updated 2026-08-21

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.join(sep). The concat filter can cheaply double arrays of references, after which join materializes the referenced content while charging only for element count, allowing a template to exceed a configured memoryLimit by a large factor. The sibling array_to_sentence_string filter in src/filters/string.ts has the same accounting defect, and a crafted template can allocate toward V8's string or process memory limit and crash the process. This issue is fixed in version 10.27.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0063 50th percentileScored 2026-11-07

Fix Fixed liquidjs (harttle): 10.27.2liquidjs (npm): 10.27.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
harttle	liquidjs	before 10.27.2	10.27.2	Patch available	CNA
—	liquidjs (npm)	before 10.27.2	10.27.2	Patch available	GHSA-4r6h-5v86-94p3

liquidjs Vendorharttle Affected before 10.27.2 Fixed in 10.27.2 Patch available CNA
liquidjs (npm) Vendor— Affected before 10.27.2 Fixed in 10.27.2 Patch available GHSA-4r6h-5v86-94p3

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:liquidjs:liquidjs::::::::	—	—	harttle

cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:*:*:* Versions — — ·harttle

Remediation

Fix · CNA liquidjs (harttle) Fixed in 10.27.2
Fix · GHSA-4r6h-5v86-94p3 liquidjs (npm) Fixed in 10.27.2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-69222
2026-10-03 Alias added: GHSA-4r6h-5v86-94p3
2026-10-28 EPSS moved to the 50th–90th percentile

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2026-69222

Other 5

TI-2026-33363 LiquidJS is Vulnerable to Remote Code Execution CVSS 3.1CRITICAL 10.0
TI-2026-44110 LiquidJS: An infinite loop vulnerability in `strip_html` filter CVSS 4.0HIGH 8.7
TI-2026-40114 LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce CVSS 4.0HIGH 8.2
TI-2026-33362 LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex CVSS 3.1HIGH 7.5
TI-2026-29912 LiquidJS is vulnerable to Denial of Service via circular block reference in layout CVSS 3.1HIGH 7.5
TI-2026-28394 Information disclosure in harttle liquidjs CVSS 3.1HIGH 7.5

See all 18 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences