LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version
    10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop,
    consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap
    out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service
    attack. This issue has been patched in version 10.25.7. (CVE-2026-41311)

ID	Name	Product	Family	Type	Severity
463638	Echo: liquidjs: security update to 10.25.7	Tenable Cloud Security	Echo Local Security Checks	Local	medium
463638	Echo: liquidjs: security update to 10.25.7	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
440821	SCA: security update for liquidjs (GHSA-4rc3-7j7w-m548)	Tenable Cloud Security	SCA Checks	Local	medium
440821	SCA: security update for liquidjs (GHSA-4rc3-7j7w-m548)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-41311

medium

Tenable Plugins

medium

medium

medium

medium