CVE-2026-61556 LiquidJS: An infinite loop vulnerability in `strip_html` filter
An attacker can cause a denial of service in LiquidJS by providing a specific malformed HTML string to the strip_html filter, leading to an infinite loop.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-61556?
CVE-2026-61556 is a high-severity denial of service vulnerability in harttle liquidjs, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. From 10.26.0 until 10.27.1, the strip_html filter in src/filters/html.ts can enter an infinite loop when an input string contains <, includes at least one preceding character, and has no later >. In strip_html, the search for the next opener advances lt while the loop index remains unchanged when the closer search returns -1, and the equality-only stall guard does not exit because the loop index is less than lt. Reprocessing the same state indefinitely blocks template rendering and can cause denial of service with an input as short as a<. This issue is fixed in version 10.27.1.
Weakness: CWE-835
Which versions are affected by CVE-2026-61556?
2 open source packages ship an affected version, including liquidjs.
| Package | Affected | Fixed in |
|---|---|---|
liquidjs npm | From 10.26.0 | 10.27.1 |
liquidjs npm | From 10.26.0 | 10.27.1 |
How do I fix CVE-2026-61556?
Upgrade liquidjs to 10.27.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-61556 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-61556 exists.
Sources
Also known as GHSA-m7fp-h3p4-hr49, MINI-3xp4-pcq3-xvwq, MINI-mc2w-mq8f-9cr8, MINI-ppq2-p7fg-39c2.