HIGH SeverityCVSS 3.17.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVE-2026-41311
Last updated May 09, 2026 · Published May 09, 2026
Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.
Affected products
1 listed- harttle:liquidjs
Mappings
CWE
CWE-674
CAPEC
None listed.
Related
CVE® content © MITRE Corporation. Licensed under the CVE Terms of Use. Terms