Is CVE-2026-34166 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-34166 being exploited in the wild.

How severe is CVE-2026-34166?

Low severity, with a CVSS score of 3.7, published 8 April 2026.

Which products and versions are affected?

liquidjs (npm) SEMVER:introduced=0,fixed=10.25.3.

Is there a fix for CVE-2026-34166?

Yes. liquidjs (npm): upgrade to 10.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-34166 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-34166?

Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-34166: LiquidJS denial of service via memory limit bypass in replace filter

CVE-2026-34166 · Severity: low · CVSS 3.7 · Published 2026-04-08

LiquidJS is a template engine used to generate web content, similar to those used by Shopify and GitHub Pages. A flaw in its memory management allows an attacker to bypass safety limits designed to prevent the application from using too much memory. By providing a specially crafted template, an attacker can cause the server to crash or become unresponsive, leading to a denial of service.

Technologies: liquidjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-34166 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-34166 being exploited in the wild.
How severe is CVE-2026-34166?: Low severity, with a CVSS score of 3.7, published 8 April 2026.
Which products and versions are affected?: liquidjs (npm) SEMVER:introduced=0,fixed=10.25.3.
Is there a fix for CVE-2026-34166?: Yes. liquidjs (npm): upgrade to 10.25.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-34166 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-34166?: Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

liquidjs (npm): upgrade to 10.25.3 or later
```
npm install liquidjs@10.25.3
```

Technical details

A vulnerability exists in the 'replace' filter of LiquidJS where memory usage is incorrectly accounted for when the 'memoryLimit' option is enabled. The engine charges the sum of the input lengths (string, pattern, and replacement) to the memory limiter, but the actual output generated by 'str.split(pattern).join(replacement)' can be quadratically larger if the pattern occurs frequently. An attacker controlling template content can achieve approximately 2,500x memory amplification, bypassing DoS protections to cause out-of-memory (OOM) conditions. This issue is fixed in version 10.25.3 by accurately calculating the output size based on the number of pattern occurrences.

Affected products

harttle LiquidJS < 10.25.3

Identifiers

CVE-2026-34166
GHSA-mmg9-6m6j-jqqx

Timeline

2026-04-06: patched: Fix committed in version 10.25.3
2026-04-08: advisory: GitHub Security Advisory published
2026-04-08: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.