CVE-2026-45357

Deferred Deferred - Pending Action

Date Format Memory Exhaustion in LiquidJS

Publication date: 2026-06-17

Last updated on: 2026-06-22

Assigner: GitHub, Inc.

Description

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-17

Last Modified

2026-06-22

Generated

2026-07-08

AI Q&A

2026-06-18

EPSS Evaluated

2026-07-06

NVD

CVE-2026-45357

Affected Vendors & Products

Vendor	Product	Version / Range
liquidjs	liquidjs	to 10.26.0 (exc)
liquidjs	liquidjs	10.26.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability exists in LiquidJS, a JavaScript template engine. In versions 10.25.7 and below, the date filter's strftime implementation improperly handles width specifiers such as %9999999d by forwarding them unchecked into string padding functions. This causes unbounded string concatenation in the pad loop without respecting memory or render limits, which are supposed to control resource usage.

As a result, a small template using a large width specifier (e.g., {{ x | date: '%5000000d' }}) can produce megabytes of output and consume unbounded CPU resources. This bypasses the intended memoryLimit and renderLimit protections, leading to excessive memory allocation and CPU usage.

The issue has been fixed in version 10.26.0.

Impact Analysis

Exploitation of this vulnerability can cause large memory allocations and high CPU usage during template rendering. This can lead to denial of service conditions such as out-of-memory (OOM) crashes or severe performance degradation on systems running vulnerable versions of LiquidJS.

Mitigation Strategies

To mitigate this vulnerability, upgrade LiquidJS to version 10.26.0 or later, where the issue has been fixed.

Avoid using untrusted templates that include the date filter with large width specifiers such as %9999999d to prevent unbounded memory and CPU usage.

Compliance Impact

The vulnerability in LiquidJS allows for unbounded memory and CPU usage, potentially causing denial of service (DoS) conditions through large memory allocations and crashes.

However, there is no information provided about how this vulnerability impacts compliance with common standards and regulations such as GDPR or HIPAA.

Hi! I’m here to help you understand CVE-2026-45357. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70