# CVE-2026-44645: LiquidJS denial of service via renderLimit bypass in empty loops

Source: https://junglewise.ai/threats/cve-2026-44645-liquidjs-denial-of-service-via-renderlimit-bypass-in-empty-loops  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-44645 · Severity: medium · CVSS 6.5 · Published 2026-06-17

LiquidJS is a template engine used to generate dynamic content, often in multi-tenant environments like email marketing or website builders. A flaw in its resource management allows a user to bypass time-based safety limits by submitting a specially crafted template with an empty loop. This can cause the server to freeze for several seconds, leading to a denial-of-service condition where the application becomes unresponsive to other users.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-44645 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44645 being exploited in the wild.

**How severe is CVE-2026-44645?** Medium severity, with a CVSS score of 6.5, published 17 June 2026.

**Which products and versions are affected?** liquidjs (npm) <= 10.25.7, SEMVER:introduced=0,last_affected=10.25.7.

**Is there a fix for CVE-2026-44645?** A patch was published on 2026-05-14: Version 10.26.0 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44645 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-44645?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability in LiquidJS versions 10.25.7 and below allows for uncontrolled resource consumption (CWE-400). The 'renderLimit' option, intended to bound the execution time of template rendering, is only checked within the loop that processes template nodes. By providing a '{% for %}' or '{% tablerow %}' tag with an empty body, an attacker can force the engine to iterate through a large collection without ever triggering the time-limit check. This bypasses the wall-clock budget and allows a single render call to monopolize the Node.js event loop for an attacker-controlled duration, scaling linearly with the size of the collection. The issue is fixed in version 10.26.0 by moving the limit check to the entry point of the rendering function.

## Affected products

- harttle liquidjs <= 10.25.7

## Identifiers

- CVE-2026-44645
- GHSA-8xx9-69p8-7jp3

## Timeline

- 2026-05-14: patched: Version 10.26.0 released
- 2026-05-24: advisory: GitHub Security Advisory published
- 2026-06-17: disclosed: CVE-2026-44645 published

## References

- [https://github.com/harttle/liquidjs/commit/5b9c3469085e01c79e2d0af28e2a13f730e1793d](https://github.com/harttle/liquidjs/commit/5b9c3469085e01c79e2d0af28e2a13f730e1793d)
- [https://github.com/harttle/liquidjs/releases/tag/v10.26.0](https://github.com/harttle/liquidjs/releases/tag/v10.26.0)
- [https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3](https://github.com/harttle/liquidjs/security/advisories/GHSA-8xx9-69p8-7jp3)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS join filter uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter)
- [LiquidJS infinite loop in strip_html filter](https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter)
- [LiquidJS remote code execution via crafted templates](https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)