Description
The replace_first filter in LiquidJS uses JavaScript’s String.prototype.replace() which interprets $& as a backreference to the matched substring. The filter only charges memoryLimit for the input string length, not the amplified output.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 10.24.0
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
- @sveltejs/kit has memory amplification DoS vulnerability in Remote Functions binary form deserializer (application/x-sve - CVE-2026-22803
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
You might also like:
See something that needs correcting? Let us knowUpdated March 30, 2026