CVE-2026-33285: LiquidJS Memory Limit Bypass Leading to Process Crash
Summary
CVE-2026-33285: LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash. Affects liquidjs versions < 10.24.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
LiquidJS is a powerful templating engine for JavaScript that allows developers to create dynamic content by rendering templates with data. It is widely used in applications such as content management systems (CMS) and email template editors. LiquidJS includes a memory limit feature to prevent excessive memory usage during template rendering. However, a vulnerability exists that allows attackers to bypass this memory limit, leading to potential denial of service (DoS) attacks.
Vulnerability Detail
The vulnerability in LiquidJS arises from its handling of range expressions in the memory limit mechanism. When reverse range expressions are used, such as (100000000..1), the calculation for memory usage results in a negative value. This negative value is not properly validated, allowing attackers to allocate unlimited memory. When combined with certain string operations, this can lead to a V8 Fatal error that crashes the Node.js process, resulting in a complete denial of service from a single HTTP request. The vulnerability is particularly dangerous because it cannot be caught by JavaScript error handling mechanisms, leading to immediate termination of the entire Node.js service.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using reverse range expressions in your Liquid templates. Ensure that any user-supplied templates are sanitized and do not allow for the creation of such expressions, which can lead to the vulnerability being exploited.
Conclusion
The vulnerability CVE-2026-33285 in LiquidJS poses a significant risk by allowing attackers to bypass memory limits and crash the Node.js process. It is crucial for developers using LiquidJS to update to the patched version and implement workarounds to prevent exploitation. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for liquidjs →
FAQ
CVE-2026-33285 is a vulnerability in LiquidJS that allows attackers to bypass memory limits, leading to potential denial of service by crashing the Node.js process.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to use the Vulert playground without signup.
The consequences include complete denial of service, as the Node.js process can be crashed by a single malicious HTTP request, affecting all users of the application.
Yes, a patch is available in LiquidJS version 10.25.0 and later. It is recommended to update to this version to mitigate the vulnerability.
Yes, if an attacker can control the Liquid template content, they can exploit this vulnerability remotely, leading to a denial of service.
References
Related vulnerabilities
Recent vulnerabilities recorded for liquidjs.
