CVE-2026-61556: LiquidJS infinite loop in strip_html filter

CVE-2026-61556 · Severity: high · CVSS 4 · Published 2026-09-03

LiquidJS is a popular JavaScript template engine that processes dynamic content. Its strip_html filter is designed to remove HTML tags from text. A flaw in this filter causes it to enter an infinite loop when processing certain malformed HTML, consuming 100% of CPU and making the application unresponsive. An attacker can trigger this with minimal input, causing denial of service to any application relying on this library.

Technologies: liquidjs (npm). Vendors: npm.

Quick answers

Is CVE-2026-61556 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-61556 being exploited in the wild.
How severe is CVE-2026-61556?
High severity, with a CVSS score of 4, published 3 September 2026.
Which products and versions are affected?
liquidjs (npm) >= 10.26.0, < 10.27.1, SEMVER:introduced=10.26.0,fixed=10.27.1.
Is there a fix for CVE-2026-61556?
Yes. liquidjs (npm): upgrade to 10.27.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-61556 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-61556?
Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • liquidjs (npm): upgrade to 10.27.1 or later
    npm install liquidjs@10.27.1

Technical details

The vulnerability is a loop-with-unreachable-exit-condition (CWE-835) in the strip_html function in src/filters/html.ts. The function iterates through a string looking for '<' characters and attempts to match them with closing '>' characters by checking against a Map of HTML block patterns. When a '<' is found but no closing '>' exists (and the pattern doesn't match any known openers like '<script' or '<style'), the code fails to advance the loop counter 'i', causing it to re-examine the same position indefinitely. The vulnerable condition 'if (i === lt) return...' should be 'if (i <= lt) return...' to handle cases where i never updates. This affects LiquidJS versions >= 10.26.0 and < 10.27.1. The vulnerability is remotely triggerable via any template input processed by the filter.

Affected products

  • harttle liquidjs >= 10.26.0, < 10.27.1

Identifiers

  • CVE-2026-61556
  • GHSA-m7fp-h3p4-hr49

Timeline

  • 2026-08-17: disclosed: GitHub advisory published
  • 2026-08-19: advisory: CVE-2026-61556 published in National Vulnerability Database
  • 2026-09-03: patched: Version 10.27.1 released with fix changing equality check to less-than-or-equal

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.