LiquidJS: `pop` filter bypasses `memoryLimit` accounting that its array-filter siblings enforce

Description

CWE: CWE-770 (Allocation of Resources Without Limits or Throttling) — sibling class of GHSA-8xx9-69p8-7jp3 and GHSA-2546-xv4c-mc8g, applied to memoryLimit instead of renderLimit

Recommendation

Update the liquidjs package to the latest compatible version. Followings are version details:

• Affected version(s): <= 10.27.0
• Patched version(s): 10.27.1

References

• GHSA-g357-x5c3-c72p
• CVE-2026-55575
• CWE-770
• CAPEC-310
• OWASP 2021-A6

Related Issues

• LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern - CVE-2026-33287
• LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
• Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization - CVE-2026-65841
• LiquidJS's `{% render %}` tag silently bypasses per-render `ownPropertyOnly:true` via `Context.spawn()` - CVE-2026-44646

You might also like:

How to Secure your NodeJs Express Javascript Application - part 1

How to Secure your NodeJs Express Javascript Application - part 2

10 Secure Coding Best Practices to Follow in Every Project

Tags:

npm

liquidjs