Description
The date filter’s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart() in src/util/underscore.ts.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 10.25.7
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
- LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
You might also like:
See something that needs correcting? Let us knowUpdated July 09, 2026