LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many <script, <style, or <!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking the Node.js event loop. A single ~350 KB request ('<script'.repeat(50000)) stalls the process for ~10 seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs unbounded. A single unauthenticated request containing crafted untrusted input can cause severe event-loop blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections. This issue has been fixed in version 10.26.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions
    10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified
    alternatives, leading to ReDoS via quadratic backtracking. When the input contains many <script, <style,
    or <!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking
    the Node.js event loop. A single ~350 KB request ('<script'.repeat(50000)) stalls the process for ~10
    seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex
    CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs
    unbounded. A single unauthenticated request containing crafted untrusted input can cause severe event-loop
    blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections.
    This issue has been fixed in version 10.26.0. (CVE-2026-45617)

ID	Name	Product	Family	Type	Severity
460787	Echo: liquidjs: security update to 10.26.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
460787	Echo: liquidjs: security update to 10.26.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
442392	SCA: security update for liquidjs (GHSA-r7g9-xpmj-5fcq)	Tenable Cloud Security	SCA Checks	Local	high
442392	SCA: security update for liquidjs (GHSA-r7g9-xpmj-5fcq)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-45617

high

Tenable Plugins

high

high

high

high