CVE-2026-33939: Handlebars.js denial of service via malformed decorator syntax

CVE-2026-33939 · Severity: high · CVSS 7.5 · Published 2026-03-27

Handlebars is a popular library used by web applications to generate dynamic content from templates. A flaw in how it handles certain template instructions allows an attacker to crash the entire application by providing a specially crafted template. This results in a denial-of-service, making the application unavailable to legitimate users until it is restarted.

Technologies: handlebars (npm), Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9. Vendors: npm, Red Hat.

Quick answers

Is CVE-2026-33939 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-33939 being exploited in the wild.
How severe is CVE-2026-33939?
High severity, with a CVSS score of 7.5, published 27 March 2026.
Which products and versions are affected?
handlebars (npm) SEMVER:introduced=4.0.0,fixed=4.7.9; Red Hat Enterprise Linux 8 8; Red Hat Enterprise Linux 9 9.
Is there a fix for CVE-2026-33939?
Yes. handlebars (npm): upgrade to 4.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-33939 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-33939?
Check whether you run handlebars (npm), Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • handlebars (npm): upgrade to 4.7.9 or later
    npm install handlebars@4.7.9

Technical details

A vulnerability exists in Handlebars.js versions 4.0.0 through 4.7.8 where the use of unregistered decorator syntax (e.g., {{*n}}) causes the compiled template to attempt to invoke an undefined property as a function. Specifically, the generated code calls lookupProperty(decorators, "n"), which returns undefined, and then immediately attempts to execute it. This results in an unhandled TypeError that crashes the Node.js process. An attacker can exploit this by submitting a malicious template to any endpoint that compiles user-supplied input without proper error handling (try/catch). The issue is fixed in version 4.7.9. Workarounds include validating template input to reject decorator syntax or using pre-compiled templates.

Affected products

  • handlebars-lang handlebars.js >= 4.0.0, <= 4.7.8
  • Red Hat Red Hat OpenShift Dev Spaces 3.27 3.27
  • Red Hat Logging Subsystem for Red Hat OpenShift 5
  • Red Hat Red Hat Enterprise Linux 8 8
  • Red Hat Red Hat Enterprise Linux 9 9

Identifiers

  • CVE-2026-33939
  • GHSA-9cx6-37pm-9jff

Timeline

  • 2026-03-24: other: Fix authored
  • 2026-03-26: patched: Version 4.7.9 released
  • 2026-03-26: advisory: GitHub Security Advisory published
  • 2026-03-27: disclosed: CVE published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.