CVE-2026-33287

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d	Patch
https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v	Exploit Vendor Advisory
https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*

History

30 Mar 2026, 16:46

Type	Values Removed	Values Added
First Time		Liquidjs Liquidjs liquidjs
References	~~() https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d -~~	() https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d - Patch
References	~~() https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v -~~	() https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v - Exploit, Vendor Advisory
CPE		cpe:2.3:a:liquidjs:liquidjs::::::node.js::*

Information

Published : 2026-03-26 01:16

Updated : 2026-03-30 16:46

NVD link : CVE-2026-33287

Mitre link : CVE-2026-33287

CVE.ORG link : CVE-2026-33287

JSON object : View

Products Affected

liquidjs

liquidjs

CWE

CWE-20

Improper Input Validation

CWE-400

Uncontrolled Resource Consumption

{"id": "CVE-2026-33287", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2026-03-26T01:16:27.530", "references": [{"url": "https://github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v", "tags": ["Exploit", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-20"}, {"lang": "en", "value": "CWE-400"}]}], "descriptions": [{"lang": "en", "value": "LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue."}, {"lang": "es", "value": "LiquidJS es un motor de plantillas compatible con Shopify / GitHub Pages en JavaScript puro. Antes de la versi\u00f3n 10.25.1, el filtro 'replace_first' en LiquidJS utiliza 'String.prototype.replace()' de JavaScript, que interpreta '$&' como una retroreferencia a la subcadena coincidente. El filtro solo carga 'memoryLimit' por la longitud de la cadena de entrada, no por la salida amplificada. Un atacante puede lograr una amplificaci\u00f3n exponencial de la memoria (hasta 625.000:1) mientras se mantiene dentro del presupuesto de 'memoryLimit', lo que lleva a una denegaci\u00f3n de servicio. La versi\u00f3n 10.25.1 corrige el problema."}], "lastModified": "2026-03-30T16:46:03.917", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:liquidjs:liquidjs:*:*:*:*:*:node.js:*:*", "vulnerable": true, "matchCriteriaId": "7E49E8C9-5FB9-40CA-BE2C-AC2B6553F472", "versionEndExcluding": "10.25.1"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}