{"id":"CVE-2026-45357","revision":"af60c72ca0c84b398e3ee4909af914ea","records":[{"revision":"af60c72ca0c84b398e3ee4909af914ea","observedAt":"2026-10-27T11:12:23.45+00:00","statement":{"source":"nvd","id":"CVE-2026-45357","aliases":[],"title":"LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchec…","description":"LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.","state":0,"publishedAt":"2026-06-17T23:17:03.893+00:00","modifiedAt":"2026-10-26T11:10:00.157+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · security-advisories@github.com · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","score":7.5,"severity":"HIGH"}],"references":["https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed","https://github.com/harttle/liquidjs/releases/tag/v10.26.0","https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-45357","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-400"],"productCriteria":[],"sourceDates":{"published":"2026-06-17T23:17:03.893","lastModified":"2026-10-26T11:10:00.157"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-45357","identifiers":["CVE-2026-45357"]},"retained":false,"historicalAffected":[]}],"coverage":[]}