# CVE-2026-45357: LiquidJS DoS via unbounded width padding in date filter

Source: https://junglewise.ai/threats/cve-2026-45357-liquidjs-dos-via-unbounded-width-padding-in-date-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-17. Updated: 2026-06-20  
License: CC BY 4.0 with a link back

CVE-2026-45357 · Severity: high · CVSS 7.5 · Published 2026-06-17

LiquidJS is a template engine used to generate dynamic web content, similar to those used by Shopify and GitHub Pages. A flaw in how it handles date formatting allows an attacker to provide a specially crafted date format that forces the server to consume massive amounts of memory and processing power. This can lead to the application crashing or becoming unresponsive, bypassing built-in safety limits designed to prevent such resource exhaustion attacks.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-45357 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45357 being exploited in the wild.

**How severe is CVE-2026-45357?** High severity, with a CVSS score of 7.5, published 17 June 2026.

**Which products and versions are affected?** liquidjs (npm) <= 10.25.7, SEMVER:introduced=0,last_affected=10.25.7.

**Is there a fix for CVE-2026-45357?** A patch was published on 2026-05-10: Fix committed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45357 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-45357?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in LiquidJS versions 10.25.7 and below due to improper validation of width specifiers in the 'date' filter's strftime implementation. The regex-based parser captures width specifiers (e.g., %9999999d) and passes them unchecked to an internal padding function. This function performs unbounded string concatenation in a loop without consulting the engine's 'memoryLimit' or 'renderLimit' configurations. An attacker who can influence the date format string—a common pattern in applications allowing user-defined templates or profile-based date settings—can trigger multi-megabyte allocations and excessive CPU cycles, leading to process crashes (OOM). The issue is fixed in version 10.26.0 by capping widths and enforcing memory accounting.

## Affected products

- harttle liquidjs <= 10.25.7

## Identifiers

- CVE-2026-45357
- GHSA-hh27-hf48-9f5q

## Timeline

- 2026-05-10: patched: Fix committed to repository
- 2026-05-14: advisory: Version 10.26.0 released
- 2026-06-17: disclosed: CVE published

## References

- [https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed](https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed)
- [https://github.com/harttle/liquidjs/releases/tag/v10.26.0](https://github.com/harttle/liquidjs/releases/tag/v10.26.0)
- [https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q](https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS join filter uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter)
- [LiquidJS infinite loop in strip_html filter](https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter)
- [LiquidJS remote code execution via crafted templates](https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)