CVE-2026-33939
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk45th percentile - higher than 45% of all known CVEs
Summary
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 causes a Node.js process crash when processing a template with an unregistered decorator. A TypeError occurs when the runtime attempts to invoke an undefined value as a function.
Risk Assessment
The organization is exposed to a single-request Denial of Service (DoS) attack if the application compiles user-supplied templates without exception handling. This can lead to service disruption.
Recommendation
Upgrade Handlebars to version 4.7.9 immediately. If upgrading is not possible, wrap compilation and rendering in try/catch blocks and reject templates containing decorator syntax ({{*...}}).
Other vulnerabilities in Handlebars
See all- CVE-2026-33937Critical
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows remote code execution (RCE) by injecting malicious JavaScript into generated code. The issue stems from unsanitized `value` fields in `NumberLiteral` AST nodes during template compilation. An attacker can supply a crafted AST object to `Handlebars.compile()`, leading to arbitrary code execution on the server.
- CVE-2026-33941High
A vulnerability in the Handlebars CLI precompiler (versions 4.0.0 through 4.7.8) allows arbitrary JavaScript injection via unsanitized template filenames and CLI arguments. An attacker can execute arbitrary code in Node.js or browser environments when the generated bundle is loaded.
- CVE-2026-33940High
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows an attacker to achieve remote code execution on the server by injecting a crafted object into the template context. The object bypasses security checks in `resolvePartial()` and causes `env.compile()` to compile malicious JavaScript. The issue is fixed in version 4.7.9.
- CVE-2026-33938High
A vulnerability in Handlebars versions 4.0.0 through 4.7.8 allows arbitrary JavaScript execution on the server. The `@partial-block` special variable is stored in the template data context and can be overwritten by helpers that accept arbitrary objects. When a helper overwrites `@partial-block` with a crafted Handlebars AST, a subsequent `{{> @partial-block}}` invocation compiles and executes that AST, enabling code execution.
Original NVD description (English source)
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled templates; do not call `compile()` at request time.