Junglewise Threat Intelligence

CVE-2026-33939: Handlebars.js denial of service via malformed decorator syntax

CVE-2026-33939 · Severity: high · CVSS 7.5 · Published 2026-03-27

Technologies: Red Hat Enterprise Linux 9, Handlebars-Lang Handlebars.Js, Red Hat Enterprise Linux 8. Vendors: Red Hat.

Executive brief

Handlebars is a popular library used by web applications to generate dynamic content from templates. A flaw in how it handles certain template instructions allows an attacker to crash the entire application by providing a specially crafted template. This results in a denial-of-service, making the application unavailable to legitimate users until it is restarted.

Technical details

A vulnerability exists in Handlebars.js versions 4.0.0 through 4.7.8 where the use of unregistered decorator syntax (e.g., {{*n}}) causes the compiled template to attempt to invoke an undefined property as a function. Specifically, the generated code calls lookupProperty(decorators, "n"), which returns undefined, and then immediately attempts to execute it. This results in an unhandled TypeError that crashes the Node.js process. An attacker can exploit this by submitting a malicious template to any endpoint that compiles user-supplied input without proper error handling (try/catch). The issue is fixed in version 4.7.9. Workarounds include validating template input to reject decorator syntax or using pre-compiled templates.

Affected products

  • handlebars-lang handlebars.js >= 4.0.0, <= 4.7.8
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 3.27
  • Red Hat Logging Subsystem for Red Hat OpenShift 5
  • Red Hat Red Hat Enterprise Linux 8 8
  • Red Hat Red Hat Enterprise Linux 9 9

Timeline

  • 2026-03-24: other: Fix authored
  • 2026-03-26: patched: Version 4.7.9 released
  • 2026-03-26: advisory: GitHub Security Advisory published
  • 2026-03-27: disclosed: CVE published to NVD

References

Related threats