Description
The join filter (src/filters/array.ts:8-13) charges memoryLimit by array element count, not by the string length it produces, letting a template bypass a configured memoryLimit and allocate strings far past budget — bounded only by V8/process limits, not by memoryLimit.
Recommendation
Update the liquidjs package to the latest compatible version. Followings are version details:
- Affected version(s): <= 10.27.1
- Patched version(s): 10.27.2
References
Could your website be exposed too?
SmartScanner can check your website for LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash t and gives you actionable findings to investigate.
Start a free scanRelated Issues
- LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash - CVE-2026-33285
- LiquidJS's strip_html filter bypass via newline characters in HTML tags enables XSS - CVE-2026-44644
- LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, `.first`/`.last`, - CVE-2026-106120
- LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter - CVE-2026-34166
You might also like:
See something that needs correcting? Let us knowUpdated September 08, 2026