High severity7.5NVD Advisory· Published Mar 26, 2026· Updated Jun 17, 2026
CVE-2026-33287
CVE-2026-33287
Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the replace_first filter in LiquidJS uses JavaScript's String.prototype.replace() which interprets $& as a back reference to the matched substring. The filter only charges memoryLimit for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the memoryLimit budget, leading to denial of service. Version 10.25.1 patches the issue.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
liquidjsnpm | <= 10.24.0 | — |
Affected products
3Patches
Vulnerability mechanics
References
4- github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061dnvdPatchWEB
- github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4vnvdExploitVendor AdvisoryWEB
- github.com/advisories/GHSA-6q5m-63h6-5x4vghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2026-33287ghsaADVISORY
News mentions
0No linked articles in our index yet.