CVE-2026-45357

Description

LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

Description (MITRE) cveawg.mitre.org

Pulled from cveawg.mitre.org/api/cve/CVE-2026-45357 on 2026-07-02. Shown when MITRE's text differs from the cvelistV5 mirror.

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.

Overview

State

—

Assigner (CNA)

—

CVSS severity

high

CVSS score

7.5 / 10

CVSS vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Effective score

7.5 / 10 HIGH source: CNA overview

CWE(s)

—

Reserved

—

Published

—

Last updated

—

Source

https://www.tenable.com/cve/CVE-2026-45357

Linked Threat

CVE-2026-45357 — CVE-2026-45357

NVD triage scoring NVD CVE 2.0

Layer NVD adds on top of the CNA's CVE record — published / last-modified timestamps, exploitability / impact subscores, and the FIRST.org EPSS probability that this CVE will be exploited in the wild in the next 30 days.

NVD published

2026-06-17 23:17:03 UTC

NVD last modified

2026-06-22 18:27:30 UTC

NVD CVSS v3.1

7.5 / 10 HIGH source: security-advisories@github.com

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability subscore

3.9 / 10

Impact subscore

3.6 / 10

EPSS score

0.0039 (probability of exploitation in next 30 days)

EPSS percentile

30.46% vs all CVEs — higher = more likely to be exploited, as of 2026-07-01

NVD-assigned CWE(s): CWE-400 (differs from the CNA list above)

European Union Vulnerability Database ENISA EUVD

ENISA's official EU repository for curated vulnerability intelligence. Carries a separate identifier (EUVD-YYYY-NNNN) and frequently exposes an earlier-published description + CVSS than NVD does.

EUVD ID

EUVD-2026-37827

Assigner

GitHub_M

Published

Jun 17, 2026, 10:32:20 PM

Updated

Jun 18, 2026, 12:49:15 PM

EUVD base score (CVSS 3.1)

7.5 / 10
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EUVD-reported EPSS

0.3900

Vendors

harttle

Products

liquidjs (< 10.26.0)

Aliases

GHSA-hh27-hf48-9f5q

ENISA description: LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()/padStart(), leading to memory and render limit bypass. In src/util/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a single small template ({{ x | date: '%5000000d' }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src/liquid-options.ts:87-92) advertise as DoS controls — and which the docstring explicitly mentions for strftime — are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.

Vendor references (0)

References embedded in the original CVE record by the assigning CNA.

None in the CVE record.

MITRE references (3) cveawg.mitre.org

Pulled from MITRE's CVE Services API by the 🛰 Backfill from MITRE button.

• https://github.com/harttle/liquidjs/commit/3129d46dc95efa357b00e5a57ee1af80a13d72ed x_refsource_MISC
• https://github.com/harttle/liquidjs/releases/tag/v10.26.0 x_refsource_MISC
• https://github.com/harttle/liquidjs/security/advisories/GHSA-hh27-hf48-9f5q x_refsource_CONFIRM

Web references (2)

DuckDuckGo results ranked by threat-intel / vendor advisory domains. Generated by the 🔎 Find references (web) button above — same flow as the Remediations search.

• https://nvd.nist.gov/vuln/detail/CVE-2026-45357 tenable:nvd.nist.gov
• https://www.cve.org/CVERecord?id=CVE-2026-45357 tenable:www.cve.org

Remediations are stored against the linked Threat row; the list below is deduplicated across both pages.

• SkyBlock Patch Notes | Hypixel Forums
  web:hypixel.net

  All SkyBlock Patch Notes can be found here! You can click the Watch button in this section to be alerted when new Patch Notes are released!

  2026-06-19 02:27 UTC
• Security Update Guide - Microsoft Security Response Center
  web:msrc.microsoft.com

  Security Update Guide - Microsoft Security Response Center

  2026-06-19 02:27 UTC
• Patch - patch
  web:patchnashville.com

  Patch was born out of a love of children's fashion and classic yet modern gifting. The goal was to create a timeless yet modern boutique with a playful touch featuring children's clothing, gifts, & accessories. My hope is that you always find what you came for and feel as inspired by our collections as we are.

  2026-06-19 02:27 UTC
• May 12, 2026—KB5089549 (OS Builds 26200.8457 and 26100.8457)
  web:support.microsoft.com

  Improvements This update includes new features and quality improvements that were part of the following update: April 14, 2026—KB5083769 (OS Builds 26200.8246 and 26100.8246) April 30, 2026—KB5083631 (OS Builds 26200.8328 and 26100.8328) Preview This update addresses security vulnerabilities documented in the following guide: May 2026 Security Updates The following summary outlines key ...

  2026-06-19 02:27 UTC
• Call of Duty: Black Ops 7 Season 04 Patch Notes
  web:www.callofduty.com

  Make sure you're following @CODUpdates, @Treyarch, @RavenSoftware for critical live communications and track common Live Issues on our Trello Boards. For regular updates about all Call of Duty® related live issues, follow @CODUpdates. For updates about Call of Duty®: Black Ops 7 Multiplayer and Zombies, follow @Treyarch. For regular updates about Call of Duty®: Black Ops 7 Campaign and ...

  2026-06-19 02:27 UTC
• Home - The Patch Augusta Municipal Golf Course
  web:www.golfthepatch.com

  Now open, The Patch features a redesigned 18-hole course, led by golf course architects Tom Fazio and Beau Welling, and a new 9-hole short course, The Loop at The Patch , designed by Tiger Woods and TGR Design. Welcome to Augusta's best-in-class public golf experience.

  2026-06-19 02:27 UTC
• Microsoft Confirms It Is Urgently Working On Patch For ... - LinkedIn
  web:www.linkedin.com

  Microsoft has confirmed that it is developing a security update to address a newly disclosed zero-day vulnerability in Microsoft Defender, following the public release of exploit code that ...

  2026-06-19 02:27 UTC
• Microsoft working on a fix for RoguePlanet, a flaw that grants full PC ...
  web:www.malwarebytes.com

  Microsoft says it's working on a fix for an unpatched Defender vulnerability that can give attackers the highest level of access on Windows.

  2026-06-19 02:27 UTC
• Patch: Plants Made Easy & Delivered to your Door
  web:www.patchplants.com

  Patch helps you discover the best plants for your space, delivers them to your door and helps you look after them. Plants will turn your lounge into a living room.

  2026-06-19 02:27 UTC
• Fix It Up codes June 2026 - Pocket Tactics
  web:www.pockettactics.com

  Grab these new Fix It Up codes to redeem plenty of free euros and build up your dream garage in this fun Roblox mechanic simulator.

  2026-06-19 02:27 UTC

Only Available for Registered Users. Sign in to view.