CVE-2026-44645 harttle CVE debrief

Who should care

Users of LiquidJS, especially those who rely on the renderLimit option for DoS protection in multi-tenant template-authoring environments, should be aware of this vulnerability. They should review and adjust the renderLimit configuration, monitor for suspicious template activity, and implement additional security measures to prevent DoS attacks. Affected operators and platform administrators should prioritize updating LiquidJS to version 10.26.0 or later.

Technical summary

In LiquidJS versions 10.25.7 and below, the renderLimit option can be bypassed by a {% for %} or {% tablerow %} tag with an empty body. This allows a low-privileged template author to monopolize a Node.js event-loop worker for an attacker-controlled duration, potentially stalling in-flight requests. The vulnerability has been fixed in version 10.26.0. Deployments that rely on a finite renderLimit for DoS protection can still be forced by a single crafted template to monopolize a Node.js event-loop worker for attacker-controlled time, potentially stalling in-flight requests.

Defensive priority

Medium

Recommended defensive actions

• Update LiquidJS to version 10.26.0 or later
• Review and adjust the renderLimit configuration
• Monitor for suspicious template activity
• Implement additional security measures to prevent DoS attacks
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented

Evidence notes

The CVE record was published on 2026-06-17T23:17:03.607Z and last modified on 2026-06-22T18:27:30.807Z. The NVD entry is currently Deferred. There is limited information available about the vulnerability, and defenders should verify the affected scope and severity with the official advisory. The renderLimit option in LiquidJS versions 10.25.7 and below can be bypassed by a {% for %} or {% tablerow %} tag with an empty body, potentially causing a denial-of-service (DoS) attack. The CVE record and NVD entry provide some context, but additional verification is necessary to understand the full impact.

Official resources