PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45357 harttle CVE debrief

CVE-2026-45357 is a high-severity vulnerability in LiquidJS, a Shopify/GitHub Pages compatible template engine. The vulnerability allows for memory and render limit bypass, potentially leading to large memory allocations, high CPU usage, or OOM crashes per render. This issue was fixed in version 10.26.0. Users of LiquidJS should update to the latest version to mitigate this vulnerability. The vulnerability has a CVSS score of 7.5 and is considered high severity. It was published on June 17, 2026, and modified on June 18, 2026.

Vendor
harttle
Product
liquidjs
CVSS
HIGH 7.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-17
Original CVE updated
2026-06-22
Advisory published
2026-06-17
Advisory updated
2026-06-22

Who should care

Developers and administrators using LiquidJS in their applications should be aware of this vulnerability and take steps to mitigate it. This includes updating to the latest version of LiquidJS and reviewing their application's configuration to ensure that memory and render limits are properly set.

Technical summary

The vulnerability is caused by the date filter's strftime implementation parsing width specifiers like %9999999d and forwarding the captured width unchecked into pad()/padStart(). This leads to unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, resulting in potential memory and render limit bypass. The memoryLimit and renderLimit options advertised as DoS controls are entirely bypassed.

Defensive priority

High

Recommended defensive actions

  • Update to LiquidJS version 10.26.0 or later
  • Review application configuration to ensure memory and render limits are properly set
  • Monitor application performance and memory usage
  • Implement additional security measures to prevent potential DoS attacks
  • Review and update documentation to reflect changes to memory and render limits
  • Consider implementing additional logging and monitoring to detect potential exploitation attempts

Evidence notes

The vulnerability was reported by an unknown source and fixed in version 10.26.0. The CVE record was published on June 17, 2026, and modified on June 18, 2026. The NVD detail page provides additional information on the vulnerability.

Official resources

public