CVE-2026-41311 Details
Description
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.
A denial-of-service vulnerability has been identified in LiquidJS, a template engine compatible with Shopify and GitHub Pages. The issue arises in versions prior to 10.25.7, where a circular block reference in the layout and block tags creates an infinite recursive loop. This loop consumes all available memory, approximately 4GB, leading to a crash of the Node.js process due to a 'heap out of memory' error. The vulnerability can be exploited by any user who can submit a Liquid template, causing a complete service disruption.
Users can upgrade to LiquidJS version 10.25.7 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed May 11, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0 | [email protected] | Patch |
| https://github.com/harttle/liquidjs/releases/tag/v10.25.7 | [email protected] | ProductRelease Notes |
| https://github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-674 | Uncontrolled Recursion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| liquidjs liquidjs | < 10.25.7 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | Initial Analysis | [email protected] |
| May 11, 2026 | CVE Modified | CISA-ADP |
| May 9, 2026 | New CVE Received | [email protected] |