ReDoS Vulnerability in LiquidJS Template Engine by Harttle

CVE-2026-45617

What is CVE-2026-45617?

LiquidJS, a template engine designed for Shopify and GitHub Pages, has a vulnerability in versions 10.25.7 and earlier resulting from a faulty regex implementation within its built-in strip_html filter. This flaw allows for ReDoS attacks via quadratic backtracking when processing inputs containing multiple <script, <style, or <!-- opening tokens lacking corresponding closing tokens. The regex inefficiency causes severe performance degradation, as demonstrated by a crafted payload that can hang the processing for approximately 10 seconds, significantly hampering Node.js event loop performance. The issue, which can be triggered by unauthenticated requests, circumvents current memoryLimit protections, leading to potential denial of service. The vulnerability has been resolved in version 10.26.0.

References