Denial of Service Vulnerability in LiquidJS Template Engine by Harttle

CVE-2026-45357

What is CVE-2026-45357?

LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, contains a vulnerability in its date filter's strftime implementation. This issue arises in versions 10.25.7 and earlier due to unbounded string concatenation when parsing certain width specifiers like %9999999d, which are forwarded unchecked to functions like pad() and padStart(). This flaw allows an attacker to bypass memoryLimit and renderLimit controls, leading to the potential for excessive memory allocations, increased CPU usage, or out-of-memory crashes during rendering. Affected users are encouraged to upgrade to version 10.26.0, which resolves the issue.

References