Compliance Impact

The provided information about CVE-2026-33287 does not include any details regarding its impact on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-33287 is a vulnerability in LiquidJS, a JavaScript template engine, specifically in its `replace_first` filter. This filter uses JavaScript's native `String.prototype.replace()` method, which interprets the `$&` pattern as a backreference to the matched substring.

The vulnerability arises because LiquidJS only accounts for the input string's length when enforcing its memory limit, not the potentially much larger output string generated by repeated `$&` expansions. An attacker can exploit this by crafting a replacement string with multiple `$&` patterns, causing exponential memory amplification—up to 625,000 times the input size—while staying within the memory limit budget.

This leads to excessive memory consumption and denial of service (DoS) by blocking the Node.js event loop and making the server unresponsive. The issue was patched in version 10.25.1 by changing the replacement logic to treat replacement strings literally, preventing `$&` from being interpreted as a backreference.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can cause a denial of service (DoS) condition on servers running vulnerable versions of LiquidJS. An attacker can remotely trigger exponential memory amplification by exploiting the `replace_first` filter with crafted input, leading to excessive memory usage.

The attack bypasses the memory limit enforcement in LiquidJS, causing the Node.js event loop to block and the server to become unresponsive. Legitimate user requests may experience significant latency or fail entirely due to resource exhaustion.

• Denial of Service through memory exhaustion
• Server unresponsiveness and increased latency
• Remote exploitation without any privileges or user interaction

Useful 0 Not Useful 0

Detection Guidance

Detection of this vulnerability involves identifying usage of vulnerable LiquidJS versions (up to 10.24.x) that use the `replace_first` filter with replacement strings containing the `$&` pattern, which causes exponential memory amplification.

Since the vulnerability causes denial of service by excessive memory consumption and event loop blocking, monitoring for unusually high memory usage or latency in services using LiquidJS can be an indicator.

Specific commands to detect vulnerable versions or exploit attempts are not provided in the available resources.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade LiquidJS to version 10.25.1 or later, where the vulnerability in the `replace_first` filter has been patched.

The patch changes the `replace_first` function to treat replacement strings literally, preventing the `$&` backreference expansion and thus stopping the exponential memory amplification.

Until the upgrade is applied, avoid using the `replace_first` filter with replacement strings containing `$&` or similar patterns that could trigger the amplification.

Useful 0 Not Useful 0