Is CVE-2026-41311 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-41311 being exploited in the wild.

How severe is CVE-2026-41311?

High severity, with a CVSS score of 7.5, published 9 May 2026.

Which products and versions are affected?

liquidjs (npm) < 10.25.7, SEMVER:introduced=0,fixed=10.25.7.

Is there a fix for CVE-2026-41311?

Yes. liquidjs (npm): upgrade to 10.25.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-41311 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-41311?

Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41311: LiquidJS uncontrolled recursion in layout blocks

Q: Which products and versions are affected?

liquidjs (npm) < 10.25.7, SEMVER:introduced=0,fixed=10.25.7.

Q: Is there a fix for CVE-2026-41311?

Yes. liquidjs (npm): upgrade to 10.25.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-41311 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-41311?

Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-41311 · Severity: high · CVSS 7.5 · Published 2026-05-09

liquidjs is a popular JavaScript template engine used in CMS platforms, email builders, and SaaS applications. An attacker who can submit a malicious template with circular block references can crash the entire Node.js process by exhausting memory, causing complete service disruption. The attack requires no authentication and can be triggered with a simple template containing nested blocks with identical names.

Technologies: liquidjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-41311 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-41311 being exploited in the wild.
How severe is CVE-2026-41311?: High severity, with a CVSS score of 7.5, published 9 May 2026.
Which products and versions are affected?: liquidjs (npm) < 10.25.7, SEMVER:introduced=0,fixed=10.25.7.
Is there a fix for CVE-2026-41311?: Yes. liquidjs (npm): upgrade to 10.25.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-41311 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-41311?: Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

liquidjs (npm): upgrade to 10.25.7 or later
```
npm install liquidjs@10.25.7
```

Technical details

The vulnerability exists in src/tags/block.ts in the getBlockRender method, which implements uncontrolled recursion (CWE-674). When rendering a block in OUTPUT mode, the code looks up a same-named block in the render context and calls its render function, passing the current block as an argument. If a child template contains a block with the same name as its parent, the inner block invokes the outer block's render function, which re-renders templates containing the inner block, creating infinite recursion with no termination condition. The attack vector is network-reachable with no authentication required—any application accepting user-submitted templates is vulnerable. An attacker can craft a template using Liquid's {% layout %} and {% block %} syntax to trigger memory exhaustion (~4GB) and cause an out-of-memory crash (FATAL ERROR: JavaScript heap out of memory). The vulnerability affects all versions up to and including 10.25.2, with a fix available in version 10.25.7.

Affected products

harttle liquidjs <10.25.7

Identifiers

CVE-2026-41311
GHSA-4rc3-7j7w-m548

Timeline

2026-04-24: disclosed
2026-04-19: patched: Fix committed; version 10.25.7 released with patch
2026-04-24: advisory: GHSA-4rc3-7j7w-m548 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.