Executive brief
LiquidJS is a popular template engine used to generate dynamic web content. A flaw in its 'pop' filter allows it to bypass memory safety limits, meaning an attacker can provide a specially crafted large list that consumes excessive server memory. This can lead to a denial-of-service (DoS) condition where the server crashes or becomes unresponsive, affecting business operations and availability.
Technical details
The 'pop' array filter in 'src/filters/array.ts' fails to call 'this.context.memoryLimit.use()' before performing an O(N) allocation via array cloning. While other array filters like 'shift' or 'slice' correctly account for memory usage against the configured 'memoryLimit', 'pop' bypasses this check entirely. An attacker who can influence the size of an array passed to a template using the 'pop' filter can trigger large allocations that exceed the intended budget. This can lead to process exhaustion and Out-of-Memory (OOM) crashes in Node.js environments. The issue is fixed in version 10.27.1 by adding the missing limit check.
Affected products
- harttle liquidjs <= 10.27.0
Timeline
- 2026-07-05: disclosed: Advisory published by maintainer
- 2026-07-08: advisory: NVD publication date
- 2026-07-24: advisory: GitHub Advisory Database reviewed date
- 2026-07-24: patched: Version 10.27.1 released