Description
The replace_first filter in LiquidJS uses JavaScript’s String.prototype.replace() which interprets $& as a backreference to the matched substring. The filter only charges memoryLimit for the input string length, not the amplified output.
Recommendation
Update the liquidjs package to the latest compatible version. Followings are version details:
- Affected version(s): < 10.25.1
- Patched version(s): 10.25.1
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
- LiquidJS has an infinite loop vulnerability in its `strip_html` filter - CVE-2026-61556
- RedwoodSDK has Same-site CSRF through lack of origin validation in its server actions - CVE-2026-42190
You might also like:
See something that needs correcting? Let us knowUpdated October 29, 2026