CVE-2026-55575: LiquidJS Memory Limit Bypass via Pop Filter
Summary
CVE-2026-55575: LiquidJS: pop filter bypasses memoryLimit accounting that its array-filter siblings enforce. Affects liquidjs versions < 10.27.1. Fixed in 10.27.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LiquidJS is a powerful templating engine for JavaScript that allows developers to create dynamic web applications. It provides a variety of filters for manipulating data within templates, enhancing the flexibility and functionality of the rendering process. However, a critical vulnerability has been identified in the 'pop' filter, which can lead to excessive memory allocation, undermining the intended memory limits set by users.
Vulnerability Detail
The vulnerability arises from the 'pop' filter in LiquidJS, which allocates a full clone of its input array without properly accounting for memory usage through the 'memoryLimit' context. Unlike other array filters that enforce memory limits, 'pop' allows for unbounded memory allocation when processing arrays influenced by untrusted input. This can lead to Denial of Service (DoS) conditions as attackers can exploit this oversight to allocate large amounts of memory, potentially crashing the server. The issue is rooted in the absence of a memory limit check in the 'pop' filter's implementation, which is inconsistent with the behavior of other array filters.
How To Fix
Latest published version: 10.30.0 as of 22 Oct 2026
npm install liquidjs@10.30.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.27.1
This is the first release that contains the fix.
npm install liquidjs@10.27.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Until the package is updated, avoid using the 'pop' filter in templates that process untrusted-length arrays. Alternatively, you can register a custom 'pop' filter that includes memory limit accounting as follows:
const { Liquid } = require('liquidjs');
const liquid = new Liquid();
liquid.registerFilter('pop', function (v) {
const arr = Array.from(v ?? []);
this.context.memoryLimit.use(arr.length);
arr.pop();
return arr;
});
Conclusion
The vulnerability CVE-2026-55575 in LiquidJS poses a significant risk by allowing the 'pop' filter to bypass memory limit checks, leading to potential Denial of Service attacks. Users are encouraged to update to the patched version or implement workarounds to mitigate the risk until they can upgrade.
See every vulnerability recorded for liquidjs →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert to monitor and alert in real-time for open-source vulnerabilities. Visit the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
The vulnerability can lead to unbounded memory allocation, potentially causing Denial of Service (DoS) conditions by crashing the server due to excessive memory usage.
Yes, the vulnerability has been patched in LiquidJS version 10.27.1. It is recommended to update to this version or later.
If you cannot update immediately, avoid using the 'pop' filter with untrusted-length arrays and consider implementing a custom filter that includes memory limit accounting.
References
Related vulnerabilities
Recent vulnerabilities recorded for liquidjs.
