LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash

Vulnerability

Overview

LiquidJS, a Shopify/GitHub Pages compatible template engine, contains a flaw in its memoryLimit security mechanism. The root cause lies in the evalRangeToken function, which computes memory usage for range expressions as high - low + 1. For reverse ranges where low > high (e.g., (100000000..1)), this yields a negative value. The Limiter.use() method does not validate that the count is non-negative, so it adds the negative value to an internal counter, causing it to go negative. This allows subsequent legitimate memory allocations to bypass the configured limit [1][4].

Exploitation

An attacker can exploit this by submitting a template containing a reverse range expression (e.g., (100000000..1)) combined with a string flattening operation such as the replace filter. The negative counter effectively disables the memory limit, enabling unlimited memory allocation. When combined with V8's cons-string optimization (which builds a tree of string fragments without copying), a subsequent flattening operation (like replace) forces V8 to allocate a contiguous buffer, leading to a fatal error and process crash [1].

Impact

Successful exploitation results in a complete denial of service (DoS) from a single HTTP request. The Node.js process crashes due to a V8 fatal error, affecting all users of the application until the process is restarted. No authentication is required if the template engine is exposed to user input [1][2].

Mitigation

The vulnerability is patched in LiquidJS version 10.25.1. The fix adds a check in Limiter.use() to only process positive counts, preventing the counter from going negative [4]. Users should upgrade immediately. No workarounds are documented; restricting access to template rendering endpoints can reduce risk but does not eliminate it.