Executive brief
hbs is an Express view engine wrapper for Handlebars that renders templates. Version 4.3.0 can crash the entire Node.js process when an async helper resolves to an object with a non-callable toHTML property, causing an uncaught exception that terminates the application without sending any response. This can be triggered remotely if async helpers process externally-controlled data like JSON from user input.
Technical details
hbs 4.3.0 is vulnerable to a denial of service via unhandled exception in async helper output escaping (CWE-248). The vulnerability is rooted in output-escaping logic introduced by CVE-2026-16231 fix: when Handlebars' escapeExpression function encounters a value with a truthy toHTML property, it attempts to call toHTML() as a method. If toHTML is not callable (e.g., a string), a TypeError is thrown. Because async helpers execute on a later event loop tick outside the render function's try/catch block, this exception is uncaught and terminates the Node.js process. The vulnerability requires no authentication or user interaction and is remotely triggerable when async helpers accept externally-influenced data (e.g., JSON.parse output). Only version 4.3.0 is affected; 4.2.1 and earlier did not escape async helper values. The patch is available in version 4.3.1.
Affected products
- npm hbs 4.3.0
Timeline
- 2026-09-11: disclosed: Published in OpenJS Foundation security advisories and GitHub Security Advisory GHSA-3c55-w9jx-p5jr
- 2026-09-11: patched: Fixed in hbs 4.3.1