CVE-2026-45617: LiquidJS strip_html ReDoS Denial of Service Vulnerability

Technical summary

CVE-2026-45617 is a regular expression denial of service (ReDoS) vulnerability in LiquidJS's strip_html filter. The filter uses a regex pattern with four lazy-quantified alternatives that exhibit catastrophic backtracking behavior when processing malformed input. Specifically, when the input contains multiple opening tokens (`<script`, `<style`, `<!--`) without corresponding closers, the V8 engine's regex matcher backtracks quadratically: a 350 KB payload induces ~10 seconds of CPU stalling, with blocking time scaling as O(N²) relative to input size. The vulnerability persists even when LiquidJS is configured with a memoryLimit, because the regex engine operates outside the memory-charge mechanism—only the string length is counted against the limit, not regex CPU cost. This allows a single unauthenticated request to saturate Node.js worker threads and degrade or halt service availability.

Business impact

Organizations deploying LiquidJS—particularly those rendering user-supplied or third-party templates in web services—face a straightforward denial-of-service risk. An attacker can send a single HTTP POST or GET request containing crafted template input to reliably stall the application for seconds, causing request timeouts and user-facing unavailability. Multi-worker setups (e.g., cluster or load-balanced deployments) can be saturated if multiple requests are sent concurrently. Recovery requires application restart. This is especially critical for platforms offering template customization or dynamic template rendering without strict input validation, and for systems where template processing is on the hot path of request handling.

Affected systems

LiquidJS versions 10.25.7 and earlier are vulnerable. The vulnerability affects any Node.js application that uses LiquidJS to render templates, particularly those that accept untrusted or user-supplied template strings and pass them through the strip_html filter. Common scenarios include: Shopify custom app backends, static site generators (e.g., Jekyll plugins using LiquidJS), content management systems with template customization, and any service that processes template data from external sources. The exact scope of third-party integrations depends on adoption of vulnerable LiquidJS versions in downstream packages.

Exploitability

Exploitability is very high. No authentication, special privileges, or user interaction is required. An attacker can craft the malicious input locally, verify the payload size and backtracking cost in a test environment, and then send a single HTTP request to a vulnerable application. Public proof-of-concept is trivial: `'<script'.repeat(50000)` embedded in template data causes observable stalling. The attack surface is broad wherever untrusted input reaches the strip_html filter or template rendering pipeline. The only practical barriers are network-level input size limits (e.g., max POST body size) or explicit input validation before passing data to LiquidJS.

Remediation

Upgrade LiquidJS to version 10.26.0 or later, which contains a corrected regex pattern that avoids catastrophic backtracking. For applications that cannot upgrade immediately, implement mitigation: validate and sanitize template input before rendering (reject unexpectedly large payloads or strings with excessive consecutive opening tags), configure web server or application-level request size limits to reject payloads larger than typical template sizes, and consider disabling or guarding the strip_html filter if it is not essential to your use case. Monitor Node.js event loop lag and CPU usage to detect exploitation attempts.

Patch guidance

Verify your LiquidJS version using `npm list liquidjs` or by checking package-lock.json. If 10.25.7 or earlier is in use, upgrade by running `npm install [email protected]` (or the latest stable version). Update your package.json and verify compatibility with your application's other dependencies before deploying to production. The fix is contained in LiquidJS's regex pattern for the strip_html filter; no configuration changes or API migrations are needed. Test template rendering with your existing test suite to confirm no behavioral regressions. If you maintain a dependency on an older LiquidJS version through a transitive dependency, request that upstream package maintainers update their LiquidJS requirement.

Detection guidance

Monitor for exploitation by observing Node.js event loop latency and CPU usage spikes correlated with incoming requests. Enable application performance monitoring (APM) to log requests that trigger extended regex execution times. At the network level, log and alert on requests with unusually large payloads or repetitive malformed HTML-like sequences (e.g., many consecutive `<script` or `<!--` tokens). In application logs, look for entries showing template rendering delays or timeouts. If you have access to LiquidJS internals, instrument the strip_html filter to measure regex execution time and flag slow operations. Query web server logs for POST/GET requests with payloads in the hundreds of kilobytes range directed at template rendering endpoints.

Why prioritize this

This vulnerability merits immediate patching because: (1) CVSS 7.5 (HIGH) reflects significant availability impact; (2) exploitability is trivial—no special tools, authentication, or user interaction needed; (3) the attack surface is broad for any service accepting user templates; (4) impact is severe and user-facing (service stalling); (5) the patch is simple and low-risk (regex fix with no API changes); (6) the vulnerability is public and likely to be targeted once widely known. Organizations should prioritize patching production services before considering lower-criticality updates.

Risk score, explained

CVSS 3.1 score of 7.5 reflects a HIGH severity: Network Attack Vector (AV:N), Low Attack Complexity (AC:L), No authentication required (PR:N), No user interaction (UI:N), scope unchanged (S:U), no confidentiality or integrity impact, but high availability impact (A:H). The score appropriately captures that an unauthenticated attacker can remotely and trivially degrade or halt service availability, but does not account for data breach or system compromise. In practical terms, the severity is driven by the ease of exploitation and direct impact on application uptime rather than stealth or lateral movement potential.

Frequently asked questions