LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-33287 · Microsoft / collected KEV context

EUVD-2026-16064

GHSA-6q5m-63h6-5x4v

cve-program · CVE-2026-33287

• https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v
• https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d

euvd · EUVD-2026-16064

• https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v
• https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d

nvd · CVE-2026-33287

• https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d
• https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v

osv · GHSA-6q5m-63h6-5x4v

• https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v
• https://nvd.nist.gov/vuln/detail/CVE-2026-33287
• https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d
• https://github.com/harttle/liquidjs
• https://github.com/harttle/liquidjs/blob/v10.25.1/CHANGELOG.md
• https://github.com/harttle/liquidjs/releases/tag/v10.25.1

• LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern · Source adds a fixed version · 29 Oct 2026