LiquidJS bug can freeze sites with one bad string

Published September 3, 2026 CVE-2026-61556

A bug in the LiquidJS template engine lets a short piece of text freeze a website or app. Sending text like a single letter followed by a stray "<" symbol can make the site stop responding.

Severity
HighCVSS 4.0 · 8.7
Fix
Fixed in 10.27.1Fix recorded on Sep 3, 2026
Affected versions
10.26.0 or newer, but before 10.27.1
Weakness
CWE-835Infinite Loop
Exploit likelihood
0.39% in 30 daysEPSS, higher than 33% of known flaws
Affects
liquidjs npm+1 more

How it works

A tool built into LiquidJS for stripping HTML tags out of text gets stuck checking the same spot over and over when it sees a "<" with no matching ">" after it, so it never finishes and the program hangs.

What to do

Run npm list liquidjs in your project and check whether the installed version falls between 10.26.0 and 10.27.1, and check whether your code calls the strip_html filter on any text that outsiders can submit.

Run this in the application environment you want to check:

npm list liquidjs

Update to LiquidJS 10.27.1 or later with npm install liquidjs@10.27.1, or a newer version, and redeploy before letting any external input reach strip_html.

Technical details

Affected software: liquidjs npm, GitHub Pages

CVE-2026-61556 affects the strip_html filter in src/filters/html.ts. When the input contains at least one character before a "<" and no later "", the loop that searches for the next tag opener advances its lt pointer but never advances the main index i, so the stall-guard condition i === lt is never satisfied and the loop repeats the same state forever. A minimal trigger string is as short as "a<".

This is a CWE-835 (infinite loop) denial-of-service issue, not memory corruption or code execution. Fixed in liquidjs 10.27.1.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low No extra steps to bypass built-in attack protections
  • Required conditions None No particular deployment or execution condition is required
  • Privileges required None Attacker needs no account or login
  • User action None No action by another user is required
  • Vulnerable system: Data exposure None No data disclosure
  • Vulnerable system: Data changes None No data tampering
  • Vulnerable system: Service disruption High The service can stop or suffer serious disruption
  • Other systems: Data exposure None No additional impact beyond the vulnerable system
  • Other systems: Data changes None No additional impact beyond the vulnerable system
  • Other systems: Service disruption None No additional impact beyond the vulnerable system
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N Open in FIRST.org calculator

References

View Original Source