CVE-2026-33287 Details

A denial-of-service vulnerability has been identified in LiquidJS versions prior to 10.25.1. The issue arises in the replace_first filter, which uses JavaScript's String.prototype.replace() method. This method interprets the replacement pattern '$&' as a backreference to the matched substring. The filter only accounts for the input string length in its memory usage, not the significantly larger output that can result from such expansions. This oversight allows an attacker to create a string that amplifies memory usage exponentially, by a factor of up to 625,000:1, while remaining within the application's memory limit. The vulnerability leads to excessive memory consumption, causing a denial-of-service condition by disrupting normal application performance.

Users should upgrade to LiquidJS version 10.25.1 or later, where this vulnerability has been patched.