{"id":"CVE-2026-45617","sourceIdentifier":"security-advisories@github.com","published":"2026-06-17T23:17:04.033","lastModified":"2026-10-25T23:10:00.167","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many <script, <style, or <!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking the Node.js event loop. A single ~350 KB request ('<script'.repeat(50000)) stalls the process for ~10 seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs unbounded.  A single unauthenticated request containing crafted untrusted input can cause severe event-loop blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections. This issue has been fixed in version 10.26.0."},{"lang":"es","value":"LiquidJS es un motor de plantillas compatible con Shopify/GitHub Pages escrito en JavaScript puro. En las versiones 10.25.7 e inferiores, el filtro incorporado strip_html utiliza una expresión regular (regex) que contiene cuatro alternativas cuantificadas perezosamente defectuosas, lo que lleva a ReDoS a través de retroceso cuadrático. Cuando la entrada contiene muchos tokens de apertura <script, <style o  [comment]  sin sus cierres correspondientes, el motor de expresiones regulares V8 realiza un retroceso O(N²), bloqueando el bucle de eventos de Node.js. Una única solicitud de ~350 KB (’<script’.repeat(50000)) detiene el proceso durante ~10 segundos; el costo crece cuadráticamente con el tamaño de la entrada. El memoryLimit: Infinity predeterminado no limita la CPU de la expresión regular, e incluso cuando está configurado, strip_html solo carga str.length al límite - la expresión regular en sí se ejecuta sin límites. Una única solicitud no autenticada que contenga una entrada no confiable manipulada puede causar un bloqueo severo del bucle de eventos y una amplificación de la CPU que satura los trabajadores de Node.js mientras elude las protecciones de memoryLimit. Este problema ha sido solucionado en la versión 10.26.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"harttle","product":"liquidjs","versions":[{"version":"< 10.26.0","status":"affected"}]}]}],"metrics":{"cvssMetricV31":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","baseScore":7.5,"baseSeverity":"HIGH","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"NONE","integrityImpact":"NONE","availabilityImpact":"HIGH"},"exploitabilityScore":3.9,"impactScore":3.6}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-06-18T15:46:01.767622Z","id":"CVE-2026-45617","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-1333"}]}],"references":[{"url":"https://github.com/harttle/liquidjs/commit/3616a744b9abeb425c217b340a2397d46176afb8","source":"security-advisories@github.com"},{"url":"https://github.com/harttle/liquidjs/releases/tag/v10.26.0","source":"security-advisories@github.com"},{"url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-r7g9-xpmj-5fcq","source":"security-advisories@github.com"},{"url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-r7g9-xpmj-5fcq","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}]}