CVE-2026-34166
LowCVSS 3.7Exploitation Probability (EPSS)
Low risk40th percentile - higher than 40% of all known CVEs
Summary
LiquidJS before version 10.25.3 has a vulnerability in the replace filter that incorrectly accounts for memory usage when the memoryLimit option is enabled. An attacker controlling template content can bypass DoS protection and cause out-of-memory conditions with approximately 2500x amplification.
Risk Assessment
The risk involves potential DoS attacks by an attacker that can cause application crashes due to memory exhaustion.
Recommendation
Update LiquidJS to version 10.25.3 or later and limit trust in template content.
Original NVD description (English source)
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.