Denial of Service Vulnerability in LiquidJS Template Engine

CVE-2026-44645

What is CVE-2026-44645?

The LiquidJS template engine, compatible with Shopify and GitHub Pages, has a vulnerability where the renderLimit option can be bypassed through an empty body {% for %} or {% tablerow %} tag. In versions 10.25.7 and earlier, this allows attackers to exploit the lack of iteration time checks, causing the server's event loop to be monopolized by a crafted template. This issue can lead to a denial of service, stalling service requests and impacting availability in environments that rely on renderLimit for protection. The vulnerability has been resolved in version 10.26.0.

References