CVE-2026-69222: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.27.2, the join filter in src/filters/array.ts computes complexity from array.length and separator length instead of the total string length produced by array.join(sep). The concat filter can cheaply double arrays of references, after which join materializes the referenced content while charging only for element count, allowing a template to exceed a configured memoryLimit by a large factor. The sibling arraytosentencestring filter in src/filters/string.ts has the same accounting defect, and a crafted template can allocate toward V8's string or process memory limit and crash the process. This issue is fixed in version 10.27.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LiquidJSto a version that resolves this vulnerability.Fixed in 10.27.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using LiquidJS before 10.27.2 are exposed when an attacker can supply or control Liquid templates that the application renders. The impact is process denial of service through excessive memory allocation.
What does an attacker need to do to trigger the crash?
The attacker needs to render a crafted template that uses concat to grow arrays of references and then materializes their contents with the join filter. The array_to_sentence_string filter has the same accounting defect and can also be used.
Does configuring memoryLimit prevent exploitation?
No. The affected filters account for array element count and separator length rather than the total resulting string length, allowing a crafted template to exceed the configured memoryLimit by a large factor.
What version fixes the issue?
Upgrade LiquidJS to version 10.27.2, which fixes the accounting defect in the affected filters.