CVE-2026-41311
CVE-2026-41311 · LiquidJS is vulnerable to Denial of Service via circular block reference in layout
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.
CVSS 7.5 · Alta · EPSS 0,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: node