PatchSiren cyber security CVE debrief
CVE-2026-45357 harttle CVE debrief
CVE-2026-45357 is a high-severity vulnerability in LiquidJS, a Shopify/GitHub Pages compatible template engine. The vulnerability allows for memory and render limit bypass, potentially leading to large memory allocations, high CPU usage, or OOM crashes per render. This issue was fixed in version 10.26.0. Users of LiquidJS should update to the latest version to mitigate this vulnerability. The vulnerability has a CVSS score of 7.5 and is considered high severity. It was published on June 17, 2026, and modified on June 18, 2026.
- Vendor
- harttle
- Product
- liquidjs
- CVSS
- HIGH 7.5
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-06-17
- Original CVE updated
- 2026-06-22
- Advisory published
- 2026-06-17
- Advisory updated
- 2026-06-22
Who should care
Developers and administrators using LiquidJS in their applications should be aware of this vulnerability and take steps to mitigate it. This includes updating to the latest version of LiquidJS and reviewing their application's configuration to ensure that memory and render limits are properly set.
Technical summary
The vulnerability is caused by the date filter's strftime implementation parsing width specifiers like %9999999d and forwarding the captured width unchecked into pad()/padStart(). This leads to unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, resulting in potential memory and render limit bypass. The memoryLimit and renderLimit options advertised as DoS controls are entirely bypassed.
Defensive priority
High
Recommended defensive actions
- Update to LiquidJS version 10.26.0 or later
- Review application configuration to ensure memory and render limits are properly set
- Monitor application performance and memory usage
- Implement additional security measures to prevent potential DoS attacks
- Review and update documentation to reflect changes to memory and render limits
- Consider implementing additional logging and monitoring to detect potential exploitation attempts
Evidence notes
The vulnerability was reported by an unknown source and fixed in version 10.26.0. The CVE record was published on June 17, 2026, and modified on June 18, 2026. The NVD detail page provides additional information on the vulnerability.
Official resources
public