CVE-2026-41311CWE-674

LiquidJS is vulnerable to Denial of Service via circular block reference in layout

High · published May 9, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
47.7
In the wild
Unconfirmed
What it is

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00594 · 47.7th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2026-05-09T04:03Z
EPSS history
Timeline
  • 09 MAY 04:03Z
    LiquidJS is vulnerable to Denial of Service via circular block reference in layout
    cvelistv5