liquidjs is vulnerable to Denial of Service (DoS)
65
Medium Risk
The documented render time budget was only checked inside the per-template render loop, so calling the renderer with an empty template list never consulted the limiter. Tags such as for and tablerow with empty bodies hit that path once per iteration and could run unbounded work while renderLimit appeared configured. The limiter is now checked at the start of renderTemplates before any template runs. A regression test covers empty for bodies under a strict limit.
You are affected if you are using a version that falls within the vulnerable range.
liquidjs is vulnerable to Denial of Service (DoS) in versions 10.15.0 - 10.25.7.
Upgrade the liquidjs library to the patch version.
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

SOC 2Compliant
ISO 27001Compliant