CVE-2026-33287 LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
An attacker can cause denial of service in LiquidJS by exploiting exponential memory amplification in the replace_first filter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33287?
CVE-2026-33287 is a high-severity denial of service vulnerability in harttle liquidjs, published on 26 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.1, the `replace_first` filter in LiquidJS uses JavaScript's `String.prototype.replace()` which interprets `$&` as a back reference to the matched substring. The filter only charges `memoryLimit` for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the `memoryLimit` budget, leading to denial of service. Version 10.25.1 patches the issue.
Which versions are affected by CVE-2026-33287?
2 open source packages ship an affected version, including liquidjs. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
liquidjs npm | All versions | 10.25.1 |
liquidjs npm | All versions | 10.25.1 |
Products include Liquidjs Liquidjs.
How do I fix CVE-2026-33287?
Upgrade liquidjs to 10.25.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33287 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33287 exists.
Other vulnerabilities in harttle liquidjs
- CVE-2026-30952 liquidjs has a path traversal fallback vulnerability
- CVE-2026-35525 LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates
- CVE-2026-41311 LiquidJS is vulnerable to Denial of Service via circular block reference in layout
- CVE-2026-33285 LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash
- CVE-2026-39859 LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read
Sources
Also known as GHSA-6q5m-63h6-5x4v, MINI-6rxg-4x29-6cxg, MINI-83rx-6hhx-p67q.