AIKIDO-2026-89061
liquidjs is vulnerable to Uncontrolled Resource Consumption
75
High Risk
This Affects:
liquidjsTL;DR
The join filter in liquidjs charges the configured memoryLimit based on the number of array elements rather than the length of the string it produces. A template author can inflate an array cheaply with repeated concat calls and then materialize a very large string through join while staying far below the accounted limit. Rendering such a template allocates memory well beyond memoryLimit and can exhaust memory and crash the process. The fix charges the filter against the actual size of the output it produces.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range, you configure memoryLimit, and you render templates authored from untrusted or user-controlled input.
Background info
liquidjs is vulnerable to Uncontrolled Resource Consumption in versions 10.15.0 - 10.27.1.
How to fix this
Upgrade the liquidjs library to the patch version.
Links
GitHub Release
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant