Executive brief
liquidjs is a popular JavaScript template engine used in CMS platforms, email builders, and SaaS applications. An attacker who can submit a malicious template with circular block references can crash the entire Node.js process by exhausting memory, causing complete service disruption. The attack requires no authentication and can be triggered with a simple template containing nested blocks with identical names.
Technical details
The vulnerability exists in src/tags/block.ts in the getBlockRender method, which implements uncontrolled recursion (CWE-674). When rendering a block in OUTPUT mode, the code looks up a same-named block in the render context and calls its render function, passing the current block as an argument. If a child template contains a block with the same name as its parent, the inner block invokes the outer block's render function, which re-renders templates containing the inner block, creating infinite recursion with no termination condition. The attack vector is network-reachable with no authentication required—any application accepting user-submitted templates is vulnerable. An attacker can craft a template using Liquid's {% layout %} and {% block %} syntax to trigger memory exhaustion (~4GB) and cause an out-of-memory crash (FATAL ERROR: JavaScript heap out of memory). The vulnerability affects all versions up to and including 10.25.2, with a fix available in version 10.25.7.
Affected products
- harttle liquidjs <10.25.7
Timeline
- 2026-04-24: disclosed
- 2026-04-19: patched: Fix committed; version 10.25.7 released with patch
- 2026-04-24: advisory: GHSA-4rc3-7j7w-m548 published