CVE-2026-69222: LiquidJS Uncontrolled Resource Consumption in `join` Filter
Summary
CVE-2026-69222: The join filter (src/filters/array.ts:8-13) charges memoryLimit by array element count, not by the string length it produces, letting a template bypass a configured memoryLimit and allocate strings far past budget — boun... Affects liquidjs versions < 10.27.2. Fixed in 10.27.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LiquidJS is a powerful templating engine for JavaScript that allows developers to create dynamic web pages by embedding logic within templates. It is widely used for rendering templates in various applications. LiquidJS provides features like filters, tags, and safe HTML rendering, making it a popular choice for developers. However, it is susceptible to a vulnerability that allows attackers to bypass memory limits, leading to potential denial-of-service (DoS) attacks.
Vulnerability Detail
The vulnerability in LiquidJS arises from the join filter, which calculates memory usage based on the number of array elements rather than the actual string length produced. This miscalculation allows templates to allocate memory far beyond the configured memoryLimit, potentially leading to process crashes. The flaw is rooted in the implementation of the join function, which does not accurately reflect the memory consumption of the strings it generates. As a result, an attacker can craft a template that exploits this oversight, causing excessive memory allocation and ultimately crashing the application.
How To Fix
Latest published version: 10.30.0 as of 22 Oct 2026
npm install liquidjs@10.30.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
10.27.2
This is the first release that contains the fix.
npm install liquidjs@10.27.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit the complexity of templates by avoiding the use of the join filter with large arrays or by implementing additional checks in your application to monitor memory usage. However, the best solution is to update to the patched version.
Conclusion
The vulnerability CVE-2026-69222 in LiquidJS poses a significant risk by allowing attackers to exploit the join filter, leading to uncontrolled resource consumption. It is crucial for developers using LiquidJS to update to the latest version to ensure their applications remain secure. Additionally, utilizing tools like Vulert can help monitor for vulnerabilities in real-time.
See every vulnerability recorded for liquidjs →
FAQ
The vulnerability allows attackers to bypass memory limits set in LiquidJS, leading to uncontrolled resource consumption and potential application crashes.
If your application uses LiquidJS versions 10.27.1 or earlier and employs the join filter in templates, it may be affected. You can check your application using Vulert's playground at Vulert Scanner.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
While the primary risk is denial-of-service, excessive memory allocation could lead to application crashes, potentially resulting in temporary data loss if not handled properly.
If an immediate update is not possible, consider implementing strict input validation and monitoring memory usage to mitigate the risk until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for liquidjs.
