CVE-2026-34166 in liquidjs
Summary
by MITRE • 04/08/2026
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 04/08/2026
The vulnerability identified as CVE-2026-34166 affects LiquidJS, a template engine designed for compatibility with Shopify and GitHub Pages, specifically targeting versions prior to 10.25.3. This issue represents a critical memory consumption flaw that undermines the engine's built-in DoS protection mechanisms. The vulnerability stems from an incorrect implementation of memory accounting within the replace filter functionality, creating a significant discrepancy between the reported memory usage and actual memory consumption during template processing.
The technical flaw manifests in how the replace filter calculates memory usage when the memoryLimit option is active. The system erroneously charges the memory limiter based on a simple summation of str.length + pattern.length + replacement.length bytes, which fails to account for the actual computational complexity of string operations. When the pattern appears frequently within the input string, the str.split(pattern).join(replacement) operation can produce output that grows quadratically rather than linearly, creating a massive amplification effect. This mathematical inconsistency allows attackers to exploit the memory accounting mechanism by crafting specific template content that triggers this exponential memory growth pattern.
The operational impact of this vulnerability is severe and potentially devastating for systems relying on LiquidJS template processing. An attacker with control over template content can bypass the intended memoryLimit DoS protection measures by approximately 2,500 times the expected memory usage. This amplification factor creates a significant risk of out-of-memory conditions that can crash applications, cause service disruptions, or enable denial-of-service scenarios across affected systems. The vulnerability particularly affects web applications that process user-supplied templates, making it a prime target for malicious actors seeking to disrupt service availability or consume excessive system resources.
The fix implemented in version 10.25.3 addresses this issue by correcting the memory accounting algorithm to properly calculate actual memory consumption during replace filter operations. This remediation ensures that the memory limiter accurately reflects the computational requirements of string operations, preventing the exponential growth scenarios that previously enabled bypassing of DoS protections. Organizations should prioritize updating to this patched version to eliminate the risk of exploitation and maintain system stability. The vulnerability aligns with CWE-1321, which addresses improper calculation of memory usage, and represents a significant concern for the ATT&CK technique T1499.004, which covers resource exhaustion attacks through memory consumption manipulation.