# CVE-2026-61556: LiquidJS infinite loop in strip_html filter

Source: https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-61556 · Severity: high · CVSS 4 · Published 2026-09-03

LiquidJS is a popular JavaScript template engine that processes dynamic content. Its strip_html filter is designed to remove HTML tags from text. A flaw in this filter causes it to enter an infinite loop when processing certain malformed HTML, consuming 100% of CPU and making the application unresponsive. An attacker can trigger this with minimal input, causing denial of service to any application relying on this library.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-61556 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-61556 being exploited in the wild.

**How severe is CVE-2026-61556?** High severity, with a CVSS score of 4, published 3 September 2026.

**Which products and versions are affected?** liquidjs (npm) >= 10.26.0, < 10.27.1, SEMVER:introduced=10.26.0,fixed=10.27.1.

**Is there a fix for CVE-2026-61556?** Yes. liquidjs (npm): upgrade to 10.27.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-61556 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-61556?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- liquidjs (npm): upgrade to 10.27.1 or later

  ```sh
  npm install liquidjs@10.27.1
  ```


## Technical details

The vulnerability is a loop-with-unreachable-exit-condition (CWE-835) in the strip_html function in src/filters/html.ts. The function iterates through a string looking for '<' characters and attempts to match them with closing '>' characters by checking against a Map of HTML block patterns. When a '<' is found but no closing '>' exists (and the pattern doesn't match any known openers like '<script' or '<style'), the code fails to advance the loop counter 'i', causing it to re-examine the same position indefinitely. The vulnerable condition 'if (i === lt) return...' should be 'if (i <= lt) return...' to handle cases where i never updates. This affects LiquidJS versions >= 10.26.0 and < 10.27.1. The vulnerability is remotely triggerable via any template input processed by the filter.

## Affected products

- harttle liquidjs >= 10.26.0, < 10.27.1

## Identifiers

- CVE-2026-61556
- GHSA-m7fp-h3p4-hr49

## Timeline

- 2026-08-17: disclosed: GitHub advisory published
- 2026-08-19: advisory: CVE-2026-61556 published in National Vulnerability Database
- 2026-09-03: patched: Version 10.27.1 released with fix changing equality check to less-than-or-equal

## References

- [https://api.github.com/users/NariyoshiChida](https://api.github.com/users/NariyoshiChida)
- [https://github.com/NariyoshiChida](https://github.com/NariyoshiChida)
- [https://api.github.com/users/NariyoshiChida/gists%7B/gist_id%7D](https://api.github.com/users/NariyoshiChida/gists%7B/gist_id%7D)
- [https://api.github.com/users/NariyoshiChida/repos](https://api.github.com/users/NariyoshiChida/repos)
- [https://avatars.githubusercontent.com/u/11674670?v=4](https://avatars.githubusercontent.com/u/11674670?v=4)
- [https://api.github.com/users/NariyoshiChida/events%7B/privacy%7D](https://api.github.com/users/NariyoshiChida/events%7B/privacy%7D)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS join filter uncontrolled resource consumption](https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter)
- [LiquidJS remote code execution via crafted templates](https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)
- [LiquidJS ReDoS in strip_html filter](https://junglewise.ai/threats/cve-2026-45617-liquidjs-redos-in-strip-html-filter)