CVE-2026-33939 Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation
Attackers can crash Node.js applications by supplying templates with malformed decorator syntax, causing an unhandled TypeError during compilation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-33939?
CVE-2026-33939 is a high-severity denial of service vulnerability in handlebars-lang handlebars.js, published on 27 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Handlebars provides the power necessary to let users build semantic templates. In versions 4.0.0 through 4.7.8, when a Handlebars template contains decorator syntax referencing an unregistered decorator (e.g. `{{*n}}`), the compiled template calls `lookupProperty(decorators, "n")`, which returns `undefined`. The runtime then immediately invokes the result as a function, causing an unhandled `TypeError: ... is not a function` that crashes the Node.js process. Any application that compiles user-supplied templates without wrapping the call in a `try/catch` is vulnerable to a single-request Denial of Service. Version 4.7.9 fixes the issue. Some workarounds are available. Wrap compilation and rendering in `try/catch`. Validate template input before passing it to `compile()`; reject templates containing decorator syntax (`{{*...}}`) if decorators are not used in your application. Use the pre-compilation workflow; compile templates at build time and serve only pre-compiled templates; do not call `compile()` at request time.
Which versions are affected by CVE-2026-33939?
2 open source packages ship an affected version, including handlebars. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
handlebars npm | From 4.0.0 | 4.7.9 |
handlebars npm | From 4.0.0 | 4.7.9 |
Products include Handlebarsjs Handlebars.
How do I fix CVE-2026-33939?
Upgrade handlebars to 4.7.9 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-33939 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-33939 exists.
Other vulnerabilities in handlebars-lang handlebars.js
- CVE-2026-33937 Handlebars.js has JavaScript Injection via AST Type Confusion
- CVE-2026-33941 Handlebars.js has JavaScript Injection in CLI Precompiler via Unescaped Names and Options
- CVE-2026-33938 Handlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-block
- CVE-2026-33940 Handlebars.js has JavaScript Injection via AST Type Confusion when passing an object as dynamic partial
- CVE-2019-20920 Arbitrary Code Execution in Handlebars
Sources
Also known as CLEANSTART-2026-JZ33423, CLEANSTART-2026-YO10703, DEBIAN-CVE-2026-33939, GHSA-9cx6-37pm-9jff, MINI-4gh3-6qch-78xm, MINI-5gv5-223m-qmx4 and 14 more.