Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

Description

When a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. ``), the compiled template calls lookupProperty(decorators, "n"), which returns undefined. The runtime then immediately invokes the result as a function, causing an unhandled TypeError: ... is not a function that crashes the Node.js process.

Recommendation

Update the handlebars package to the latest compatible version. Followings are version details:

• Affected version(s): >= 4.0.0, <= 4.7.8
• Patched version(s): 4.7.9

References

• GHSA-9cx6-37pm-9jff
• CVE-2026-33939
• CWE-754
• CAPEC-310
• OWASP 2021-A6

Related Issues

• OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header - CVE-2026-59892
• Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
• liquidjs has a Denial of Service via circular block reference in layout - CVE-2026-41311
• path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters - CVE-2026-4867

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

handlebars