liquidjs has a Denial of Service via circular block reference in layout

Description

A circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack.

Recommendation

Update the liquidjs package to the latest compatible version. Followings are version details:

• Affected version(s): < 10.25.7
• Patched version(s): 10.25.7

References

• GHSA-4rc3-7j7w-m548
• CVE-2026-41311
• CWE-674
• CAPEC-310
• OWASP 2021-A6

Related Issues

• Serialize JavaScript has CPU Exhaustion Denial of Service via crafted array-like objects - CVE-2026-34043
• Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation - CVE-2026-33939
• OpenTelemetry JavaScript: Denial of service in `JaegerPropagator` via unhandled exception on a malformed header - CVE-2026-59892
• Cloudflare Agents SDK has Insecure Direct Object Reference (IDOR) via Header-Based Email Routing - CVE-2026-1664

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

liquidjs