LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

published 2026-08-19 2 mo ago modified 2026-09-09 1 mo ago also GHSA-4r6h-5v86-94p3 , EUVD-2026-63090

cvss: 7.5; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.6%; EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits: 0; none known

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.join(sep). The concat filter can cheaply double arrays of references, after which join materializes the referenced content while charging only for element count, allowing a template to exceed a configured memoryLimit by a large factor. The sibling array_to_sentence_string filter in src/filters/string.ts has the same accounting defect, and a crafted template can allocate toward V8's string or process memory limit and crash the process. This issue is fixed in version 10.27.2.

Patch / fix

fixed in 1 links 3

npm liquidjs 10.27.2

github.com/harttle/liquidjs@7ab49f9 commit
github.com/harttle/liquidjs#925 pull request
github.com/harttle/liquidjs/releases/tag/v10.27.2 release

CISA SSVC

Exploitation: none
Automatable: yes
Technical impact: partial
Assessed: 2 mo ago (2026-08-21)

Exploit prediction

0.63% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem	package	affected	fixed in
npm	liquidjs	<10.27.2	10.27.2

Affected products

harttle liquidjs

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary