Denial of Service Vulnerability in LiquidJS Template Engine
CVE-2026-33287

7.5HIGH

Key Information:

Vendor

Harttle

Status
Liquidjs
Vendor
CVE Published:
26 March 2026

What is CVE-2026-33287?

LiquidJS is a JavaScript-based template engine that is widely used in Shopify and GitHub Pages. A captured issue in its replace_first filter, present before version 10.25.1, stemmed from the way JavaScript's String.prototype.replace() interprets the $& variable, which allows attackers to exploit this functionality. The vulnerability permits a significant memory amplification effect—up to 625,000:1—without breaching the memoryLimit restriction. This could allow an attacker to cause a denial of service by manipulating the input string, leading to potential unavailability of services that utilize LiquidJS.

Affected Version(s)

liquidjs < 10.25.1

References

https://github.com/harttle/liquidjs/security/advisories/G...
x_refsource_CONFIRM
https://github.com/harttle/liquidjs/commit/35d523026345d8...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.