Description
The replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string.
Recommendation
Update the liquidjs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 10.25.2
- Patched version(s): 10.25.3
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime) - CVE-2026-45357
- LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
- LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
You might also like:
See something that needs correcting? Let us knowUpdated April 09, 2026