# CVE-2026-33285: LiquidJS memoryLimit bypass via negative range values

Source: https://junglewise.ai/threats/cve-2026-33285-liquidjs-memorylimit-bypass-via-negative-range-values  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-33285 · Severity: low · CVSS 3.1 · Published 2026-03-25

LiquidJS is a JavaScript template engine used to render dynamic content in Node.js applications. A flaw in its memory protection mechanism allows attackers to craft malicious template input that bypasses memory limits, allocates unlimited memory, and crashes the entire server process with a single HTTP request. This results in complete denial of service to all users.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-33285 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33285 being exploited in the wild.

**How severe is CVE-2026-33285?** Low severity, with a CVSS score of 3.1, published 25 March 2026.

**Which products and versions are affected?** liquidjs (npm) SEMVER:introduced=0,last_affected=10.24.0.

**Is there a fix for CVE-2026-33285?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-33285 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33285?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a logic error in the memoryLimit enforcement mechanism. When LiquidJS evaluates reverse range expressions (e.g., `(100000000..1)` where low > high), it computes memory usage as `high - low + 1`, yielding a negative value. The Limiter.use() method fails to validate that the count parameter is non-negative, allowing the internal counter to go negative. This negative balance permits subsequent legitimate memory allocations to bypass the configured limit. Combined with V8's cons-string optimization (where repeated string concatenation creates a tree structure consuming minimal memory), an attacker can build a 134MB logical string using only kilobytes. When a filter like `replace` forces V8 to flatten the cons-string into contiguous memory, the allocation request (~268MB) triggers an uncatchable V8 Fatal error that immediately terminates the Node.js process. Attack precondition: the attacker must control the Liquid template source code (e.g., via user-supplied templates in a web application). No patch is currently available.

## Affected products

- harttle LiquidJS <=10.24.x

## Identifiers

- CVE-2026-33285
- GHSA-9r5m-9576-7f6x

## Timeline

- 2026-03-25: disclosed

## References

- [https://github.com/harttle/liquidjs/security/advisories/GHSA-9r5m-9576-7f6x](https://github.com/harttle/liquidjs/security/advisories/GHSA-9r5m-9576-7f6x)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS join filter uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter)
- [LiquidJS infinite loop in strip_html filter](https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter)
- [LiquidJS remote code execution via crafted templates](https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)