CVE-2026-33285 LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
Attackers can crash the Node.js process by bypassing memory limits with reverse range expressions in LiquidJS templates.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33285?
CVE-2026-33285 is a high-severity denial of service vulnerability in harttle liquidjs, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, LiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., `replace` filter), this causes a V8 Fatal error that crashes the Node.js process, resulting in complete denial of service from a single HTTP request. Version 10.25.1 patches the issue.
Which versions are affected by CVE-2026-33285?
2 open source packages ship an affected version, including liquidjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
liquidjs npm | All versions to 10.24.0 | None |
liquidjs npm | All versions to 10.24.0 | None |
Products include Liquidjs Liquidjs.
How do I fix CVE-2026-33285?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33285 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33285 exists.
Other vulnerabilities in harttle liquidjs
- CVE-2026-30952 liquidjs has a path traversal fallback vulnerability
- CVE-2026-35525 LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates
- CVE-2026-41311 LiquidJS is vulnerable to Denial of Service via circular block reference in layout
- CVE-2026-33287 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
- CVE-2026-39859 LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
Sources
Also known as GHSA-9r5m-9576-7f6x, MINI-25wf-pp5r-m3j2, MINI-3w8r-ghx2-wpgh.