CVE-2026-87123 is a vulnerability in the hbs Express view engine wrapper for Handlebars, version 4.3.0. The issue causes the Node.js process to crash during output escaping when an async helper resolves to an object with a truthy but non-callable toHTML property. This can occur remotely if the async helper resolves to an externally influenced object, such as parsed JSON. The vulnerability is fixed in hbs [truncated]
The hbs Express view engine, which wraps Handlebars, has a vulnerability in its registerAsyncHelper API. This API bypasses Handlebars' automatic HTML escaping, allowing an async helper to return an opaque placeholder during the first render pass. The placeholder is only escaped in the double-brace expression, and after rendering, hbs substitutes the placeholder with the raw callback return value without e [truncated]
