Description
LiquidJS’s memoryLimit security mechanism can be completely bypassed by using reverse range expressions (e.g., (100000000..1)), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., replace filter), this causes a **V8 Fatal error that crashes the Node.
Recommendation
No fix is available yet. Followings are affected versions:
- <= 10.24.0
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash and gives you actionable findings to investigate.
Start a free scanRelated Issues
- jsrsasign: Negative Exponent Handling Leads to Signature Verification Bypass - CVE-2026-4602
- LiquidJS: Root restriction bypass for partial and layout loading through symlinked templates - CVE-2026-35525
- LiquidJS: ownPropertyOnly bypass via sort_natural filter — prototype property information disclosure through sorting sid - CVE-2026-39412
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
You might also like:
See something that needs correcting? Let us knowUpdated March 30, 2026