LiquidJS: Uncontrolled Resource Consumption in `join` filter

Published September 8, 2026 CVE-2026-69222

LiquidJS: Uncontrolled Resource Consumption in join filter allows template authors to bypass memoryLimit and crash the process. The join filter (src/filters/array.ts:8-13) charges memoryLimit by array element count, not by the string length it produces, letting a template bypass a configured memoryLimit and allocate strings far past budget — bounded only by V8/process limits, not by memoryLimit.

Severity
HighCVSS 3.1 · 7.5
Fix
Update available
Affected versions
before 10.27.2
Weakness
CWE-400Uncontrolled Resource Consumption
Exploit likelihood
0.37% in 30 daysEPSS, higher than 30% of known flaws
Affects
LiquidJS

What to do

Run this in the application environment you want to check:

npm ls --all liquidjs

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact None No data disclosure
  • Integrity impact None No data tampering
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Open in FIRST.org calculator

References

View Original Source