LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)
- Severity:
- High
Description
The date filter’s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart() in src/util/underscore.ts.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 10.25.7
References
Related Issues
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
- LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
You might also like:
- Tags:
- npm
- liquidjs
Anything's wrong? Let us know Last updated on July 09, 2026