{"id":"EUVD-2026-28886","enisaUuid":"656d3e88-ee8a-3769-9f2c-90e51b596869","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.","datePublished":"May 9, 2026, 4:03:25 AM","dateUpdated":"May 11, 2026, 3:04:09 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548\nhttps://github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0\nhttps://github.com/harttle/liquidjs/releases/tag/v10.25.7\n","aliases":"CVE-2026-41311\n","assigner":"GitHub_M","epss":0.38,"enisaIdProduct":[{"id":"a0c42fd3-d42b-34aa-b456-b8d624efad19","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.25.7"}],"enisaIdVendor":[{"id":"dd64b322-eea2-3a8e-9cec-76785bbfecf1","vendor":{"name":"harttle"}}],"enisaIdVulnerability":[{"id":"29d926cf-64f1-319f-86c7-19e7d1e53e5b","vulnerability":{"id":"GHSA-4rc3-7j7w-m548","description":"liquidjs has a Denial of Service via circular block reference in layout","datePublished":"Apr 24, 2026, 3:34:00 PM","dateUpdated":"May 13, 2026, 1:38:38 PM","baseScore":0.0,"references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-41311\nhttps://github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0\nhttps://github.com/harttle/liquidjs\nhttps://github.com/harttle/liquidjs/releases/tag/v10.25.7\n","enisa_id":"EUVD-2026-28886\n","aliases":"GHSA-4rc3-7j7w-m548\nCVE-2026-41311\n","epss":0.0,"dataProcessed":"Nov 15, 2026, 2:49:26 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"50fece45-13ab-3b78-90f4-ec22fd33e284","vulnerability":{"id":"CVE-2026-41311","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.","datePublished":"May 9, 2026, 4:03:25 AM","dateUpdated":"May 11, 2026, 3:04:09 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548\nhttps://github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0\nhttps://github.com/harttle/liquidjs/releases/tag/v10.25.7\n","enisa_id":"EUVD-2026-28886\n","assigner":"GitHub_M","epss":0.38,"dataProcessed":"Nov 15, 2026, 7:21:23 AM","vulnerabilityProduct":[{"id":"90ffd82c-e412-3ea8-b72c-ffb9b04fe4c1","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.25.7"}],"vulnerabilityVendor":[{"id":"f1255181-76da-389c-840e-3363bb59ef49","vendor":{"name":"harttle"}}]}}],"enisaIdAdvisory":[]}