CVE-2026-45357: LiquidJS DoS via unbounded width padding in date filter

CVE-2026-45357 · Severity: high · CVSS 7.5 · Published 2026-06-17

LiquidJS is a template engine used to generate dynamic web content, similar to those used by Shopify and GitHub Pages. A flaw in how it handles date formatting allows an attacker to provide a specially crafted date format that forces the server to consume massive amounts of memory and processing power. This can lead to the application crashing or becoming unresponsive, bypassing built-in safety limits designed to prevent such resource exhaustion attacks.

Technologies: liquidjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-45357 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-45357 being exploited in the wild.
How severe is CVE-2026-45357?
High severity, with a CVSS score of 7.5, published 17 June 2026.
Which products and versions are affected?
liquidjs (npm) <= 10.25.7, SEMVER:introduced=0,last_affected=10.25.7.
Is there a fix for CVE-2026-45357?
A patch was published on 2026-05-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45357 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-45357?
Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in LiquidJS versions 10.25.7 and below due to improper validation of width specifiers in the 'date' filter's strftime implementation. The regex-based parser captures width specifiers (e.g., %9999999d) and passes them unchecked to an internal padding function. This function performs unbounded string concatenation in a loop without consulting the engine's 'memoryLimit' or 'renderLimit' configurations. An attacker who can influence the date format string—a common pattern in applications allowing user-defined templates or profile-based date settings—can trigger multi-megabyte allocations and excessive CPU cycles, leading to process crashes (OOM). The issue is fixed in version 10.26.0 by capping widths and enforcing memory accounting.

Affected products

  • harttle liquidjs <= 10.25.7

Identifiers

  • CVE-2026-45357
  • GHSA-hh27-hf48-9f5q

Timeline

  • 2026-05-10: patched: Fix committed to repository
  • 2026-05-14: advisory: Version 10.26.0 released
  • 2026-06-17: disclosed: CVE published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.