{"id":"EUVD-2026-37823","enisaUuid":"316daf21-0331-38d7-8100-9a5fb4db221f","description":"LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many \u003cscript, \u003cstyle, or \u003c!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking the Node.js event loop. A single ~350 KB request (\u0027\u003cscript\u0027.repeat(50000)) stalls the process for ~10 seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs unbounded.  A single unauthenticated request containing crafted untrusted input can cause severe event-loop blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections. This issue has been fixed in version 10.26.0.","datePublished":"Jun 17, 2026, 10:14:38 PM","dateUpdated":"Jun 18, 2026, 3:46:28 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-r7g9-xpmj-5fcq\nhttps://github.com/harttle/liquidjs/commit/3616a744b9abeb425c217b340a2397d46176afb8\nhttps://github.com/harttle/liquidjs/releases/tag/v10.26.0\n","aliases":"CVE-2026-45617\nGHSA-r7g9-xpmj-5fcq\n","assigner":"GitHub_M","epss":0.46,"enisaIdProduct":[{"id":"47713fb3-bf1f-3405-829a-f1701ffb815d","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.26.0"}],"enisaIdVendor":[{"id":"6c65d90e-4906-3240-a9b1-3b602def24c9","vendor":{"name":"harttle"}}],"enisaIdVulnerability":[{"id":"30b5e93c-2059-3e66-a40b-13c636b38701","vulnerability":{"id":"CVE-2026-45617","description":"LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many \u003cscript, \u003cstyle, or \u003c!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking the Node.js event loop. A single ~350 KB request (\u0027\u003cscript\u0027.repeat(50000)) stalls the process for ~10 seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs unbounded.  A single unauthenticated request containing crafted untrusted input can cause severe event-loop blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections. This issue has been fixed in version 10.26.0.","datePublished":"Jun 17, 2026, 10:14:38 PM","dateUpdated":"Jun 18, 2026, 3:46:28 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-r7g9-xpmj-5fcq\nhttps://github.com/harttle/liquidjs/commit/3616a744b9abeb425c217b340a2397d46176afb8\nhttps://github.com/harttle/liquidjs/releases/tag/v10.26.0\n","enisa_id":"EUVD-2026-37823\n","assigner":"GitHub_M","epss":0.46,"dataProcessed":"Nov 7, 2026, 7:21:28 AM","vulnerabilityProduct":[{"id":"78468f7e-8a92-3ff1-86b0-2bb68c50bb38","product":{"name":"liquidjs","vendor":{"name":"harttle"}},"product_version":"\u003c 10.26.0"}],"vulnerabilityVendor":[{"id":"0ec1f1f2-76e5-378a-a188-48bb09ec0c10","vendor":{"name":"harttle"}}]}},{"id":"ff202844-d79d-3a36-89a8-eb2d49d31be9","vulnerability":{"id":"GHSA-r7g9-xpmj-5fcq","description":"LiquidJS Vulnerable to ReDoS via Quadratic Backtracking in `strip_html` Filter Regex","datePublished":"May 27, 2026, 6:08:19 PM","dateUpdated":"Jul 9, 2026, 9:06:36 PM","baseScore":0.0,"references":"https://github.com/harttle/liquidjs/security/advisories/GHSA-r7g9-xpmj-5fcq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-45617\nhttps://github.com/harttle/liquidjs/commit/3616a744b9abeb425c217b340a2397d46176afb8\nhttps://github.com/harttle/liquidjs\nhttps://github.com/harttle/liquidjs/releases/tag/v10.26.0\n","enisa_id":"EUVD-2026-37823\n","aliases":"CVE-2026-45617\nGHSA-r7g9-xpmj-5fcq\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 2:01:03 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}