# CVE-2026-33939: Handlebars.js denial of service via malformed decorator syntax

Source: https://junglewise.ai/threats/cve-2026-33939-handlebars-js-denial-of-service-via-malformed-decorator-syntax  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-27. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-33939 · Severity: high · CVSS 7.5 · Published 2026-03-27

Handlebars is a popular library used by web applications to generate dynamic content from templates. A flaw in how it handles certain template instructions allows an attacker to crash the entire application by providing a specially crafted template. This results in a denial-of-service, making the application unavailable to legitimate users until it is restarted.

Technologies: [handlebars (npm)](https://junglewise.ai/threats/technologies/npm-handlebars), [Red Hat Enterprise Linux 8](https://junglewise.ai/threats/technologies/enterprise-linux-8), [Red Hat Enterprise Linux 9](https://junglewise.ai/threats/technologies/enterprise-linux-9). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Red Hat](https://junglewise.ai/threats/vendors/red-hat).

## Quick answers

**Is CVE-2026-33939 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-33939 being exploited in the wild.

**How severe is CVE-2026-33939?** High severity, with a CVSS score of 7.5, published 27 March 2026.

**Which products and versions are affected?** handlebars (npm) SEMVER:introduced=4.0.0,fixed=4.7.9; Red Hat Enterprise Linux 8 8; Red Hat Enterprise Linux 9 9.

**Is there a fix for CVE-2026-33939?** Yes. handlebars (npm): upgrade to 4.7.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-33939 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-33939?** Check whether you run handlebars (npm), Red Hat Enterprise Linux 8 or Red Hat Enterprise Linux 9 at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- handlebars (npm): upgrade to 4.7.9 or later

  ```sh
  npm install handlebars@4.7.9
  ```


## Technical details

A vulnerability exists in Handlebars.js versions 4.0.0 through 4.7.8 where the use of unregistered decorator syntax (e.g., {{*n}}) causes the compiled template to attempt to invoke an undefined property as a function. Specifically, the generated code calls lookupProperty(decorators, "n"), which returns undefined, and then immediately attempts to execute it. This results in an unhandled TypeError that crashes the Node.js process. An attacker can exploit this by submitting a malicious template to any endpoint that compiles user-supplied input without proper error handling (try/catch). The issue is fixed in version 4.7.9. Workarounds include validating template input to reject decorator syntax or using pre-compiled templates.

## Affected products

- handlebars-lang handlebars.js >= 4.0.0, <= 4.7.8
- Red Hat Red Hat OpenShift Dev Spaces 3.27 3.27
- Red Hat Logging Subsystem for Red Hat OpenShift 5
- Red Hat Red Hat Enterprise Linux 8 8
- Red Hat Red Hat Enterprise Linux 9 9

## Identifiers

- CVE-2026-33939
- GHSA-9cx6-37pm-9jff

## Timeline

- 2026-03-24: other: Fix authored
- 2026-03-26: patched: Version 4.7.9 released
- 2026-03-26: advisory: GitHub Security Advisory published
- 2026-03-27: disclosed: CVE published to NVD

## References

- [https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2](https://github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2)
- [https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9](https://github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9)
- [https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff](https://github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff)
- [https://access.redhat.com/errata/RHSA-2026:10175](https://access.redhat.com/errata/RHSA-2026:10175)
- [https://access.redhat.com/security/cve/CVE-2026-33939](https://access.redhat.com/security/cve/CVE-2026-33939)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2452508](https://bugzilla.redhat.com/show_bug.cgi?id=2452508)
- [https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-33939.json)

## Related threats

- [Handlebars AST validation bypass in compile and precompile](https://junglewise.ai/threats/cve-2026-106446-handlebars-provides-the-power-necessary-to-let-users-build)
- [Handlebars prototype pollution RCE via constructor bypass](https://junglewise.ai/threats/cve-2026-106445-handlebars-provides-the-power-necessary-to-let-users-build)
- [Handlebars precompile script injection in generated code](https://junglewise.ai/threats/cve-2026-106444-handlebars-provides-the-power-necessary-to-let-users-build)
- [Samba AD DC LDAP filter injection and ACL bypass in Compare requests](https://junglewise.ai/threats/cve-2026-58222-samba-ad-dc-ldap-filter-injection-and-acl-bypass-in-compare)
- [Samba KDC out-of-bounds read in kpasswd service](https://junglewise.ai/threats/cve-2026-58216-samba-kdc-out-of-bounds-read-in-kpasswd-service)