Intel

AIKIDO-2026-10834

liquidjs is vulnerable to Denial of Service (DoS)

Denial of Service (DoS) Pre-CVE
Found by Aikido Intel before public disclosure or CVE publication.
Published May 19, 2026

65

Medium Risk

This Affects:

JSliquidjs
10.15.0 - 10.25.7
Fixed in 10.26.0
Are you affected? Scan for Free

TL;DR

The documented render time budget was only checked inside the per-template render loop, so calling the renderer with an empty template list never consulted the limiter. Tags such as for and tablerow with empty bodies hit that path once per iteration and could run unbounded work while renderLimit appeared configured. The limiter is now checked at the start of renderTemplates before any template runs. A regression test covers empty for bodies under a strict limit.

Who does this affect?

You are affected if you are using a version that falls within the vulnerable range.

Background info

liquidjs is vulnerable to Denial of Service (DoS) in versions 10.15.0 - 10.25.7.

How to fix this

Upgrade the liquidjs library to the patch version.