# CVE-2026-69222: LiquidJS join filter uncontrolled resource consumption

Source: https://junglewise.ai/threats/cve-2026-69222-liquidjs-uncontrolled-resource-consumption-in-join-filter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-08. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-69222 · Severity: high · CVSS 7.5 · Published 2026-09-08

LiquidJS is a JavaScript template engine used to safely render user-supplied templates with built-in resource limits. The `join` filter incorrectly calculates memory consumption by counting array elements rather than measuring actual string output size, allowing attackers to bypass the configured memory limit and force the process to allocate gigabytes of memory, causing it to crash. An attacker can exploit this through a short malicious template.

Technologies: [liquidjs (npm)](https://junglewise.ai/threats/technologies/liquidjs). Vendors: [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-69222 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-69222 being exploited in the wild.

**How severe is CVE-2026-69222?** High severity, with a CVSS score of 7.5, published 8 September 2026.

**Which products and versions are affected?** liquidjs (npm) <= 10.27.1, SEMVER:introduced=0,fixed=10.27.2.

**Is there a fix for CVE-2026-69222?** Yes. liquidjs (npm): upgrade to 10.27.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-69222 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-69222?** Check whether you run liquidjs (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- liquidjs (npm): upgrade to 10.27.2 or later

  ```sh
  npm install liquidjs@10.27.2
  ```


## Technical details

The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in the `join` filter (`src/filters/array.ts:8-13`). The filter calculates its memory charge as `array.length * (1 + sep.length)`, counting only array element count and separator length, but the actual allocation is the sum of all element string lengths plus separators. The `concat` filter enables the attack by allowing array element count to double repeatedly at negligible cost via reference copying. When `join` materializes the referenced content into a single string, the actual heap allocation vastly exceeds the charged amount. The PoC uses 13 concat operations to grow an array from 1 to 8192 elements while only charging ~16K units, then join allocates 40MB from that array—1385× the charged amount against a 10M limit. No authentication is required; the attack succeeds against any LiquidJS instance rendering attacker-controlled templates with memoryLimit configured. The vulnerability also affects the sibling `array_to_sentence_string` filter. A fix was released in version 10.27.2.

## Affected products

- harttle LiquidJS <= 10.27.1

## Identifiers

- CVE-2026-69222
- GHSA-4r6h-5v86-94p3

## Timeline

- 2026-08-17: disclosed: GitHub Security Advisory published
- 2026-08-17: patched: Patch released in version 10.27.2
- 2026-09-08: advisory: GHSA and CVE published
- 2026-08-19: kev added: Added to NVD

## References

- [https://api.github.com/users/adamyordan](https://api.github.com/users/adamyordan)
- [https://github.com/adamyordan](https://github.com/adamyordan)
- [https://api.github.com/users/adamyordan/gists%7B/gist_id%7D](https://api.github.com/users/adamyordan/gists%7B/gist_id%7D)
- [https://api.github.com/users/adamyordan/repos](https://api.github.com/users/adamyordan/repos)
- [https://avatars.githubusercontent.com/u/9531164?v=4](https://avatars.githubusercontent.com/u/9531164?v=4)
- [https://api.github.com/users/adamyordan/events%7B/privacy%7D](https://api.github.com/users/adamyordan/events%7B/privacy%7D)

## Related threats

- [LiquidJS ownPropertyOnly bypass via inherited array indices](https://junglewise.ai/threats/cve-2026-106120-liquidjs-is-a-shopify-github-pages-compatible-template-engine-in)
- [LiquidJS infinite loop in strip_html filter](https://junglewise.ai/threats/cve-2026-61556-liquidjs-infinite-loop-in-strip-html-filter)
- [LiquidJS remote code execution via crafted templates](https://junglewise.ai/threats/cve-2026-45618-liquidjs-remote-code-execution-via-crafted-templates)
- [LiquidJS memory limit bypass in pop array filter](https://junglewise.ai/threats/cve-2026-55575-liquidjs-memory-limit-bypass-in-pop-array-filter)
- [LiquidJS ReDoS in strip_html filter](https://junglewise.ai/threats/cve-2026-45617-liquidjs-redos-in-strip-html-filter)