CVE-2026-45357
Received Received - Intake
Date Format Memory Exhaustion in LiquidJS

Publication date: 2026-06-17

Last updated on: 2026-06-17

Assigner: GitHub, Inc.

Description
LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-17
Last Modified
2026-06-17
Generated
2026-06-18
AI Q&A
2026-06-18
EPSS Evaluated
N/A
NVD
CVE-2026-45357
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
liquidjs liquidjs to 10.26.0 (exc)
liquidjs liquidjs 10.26.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in LiquidJS, a JavaScript template engine. In versions 10.25.7 and below, the date filter's strftime implementation improperly handles width specifiers such as %9999999d by forwarding them unchecked into string padding functions. This causes unbounded string concatenation in the pad loop without respecting memory or render limits, which are supposed to control resource usage.

As a result, a small template using a large width specifier (e.g., {{ x | date: '%5000000d' }}) can produce megabytes of output and consume unbounded CPU resources. This bypasses the intended memoryLimit and renderLimit protections, leading to excessive memory allocation and CPU usage.

The issue has been fixed in version 10.26.0.

Impact Analysis

Exploitation of this vulnerability can cause large memory allocations and high CPU usage during template rendering. This can lead to denial of service conditions such as out-of-memory (OOM) crashes or severe performance degradation on systems running vulnerable versions of LiquidJS.

Mitigation Strategies

To mitigate this vulnerability, upgrade LiquidJS to version 10.26.0 or later, where the issue has been fixed.

Avoid using untrusted templates that include the date filter with large width specifiers such as %9999999d to prevent unbounded memory and CPU usage.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-45357. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart