Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
CVE Vulnerability Details :
CVE-2026-41311
PUBLISHED
More InfoOfficial Page
Assigner-GitHub_M
Assigner Org ID-a0819718-46f1-4df5-94e2-005712e83aaa
View Known Exploited Vulnerability (KEV) details
Published At-09 May, 2026 | 04:03
Updated At-09 May, 2026 | 04:03
Rejected At-
▼CVE Numbering Authority (CNA)
LiquidJS is vulnerable to Denial of Service via circular block reference in layout

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.

Affected Products
Vendor
harttle
Product
liquidjs
Versions
Affected
  • < 10.25.7
Problem Types
TypeCWE IDDescription
CWECWE-674CWE-674: Uncontrolled Recursion
Type: CWE
CWE ID: CWE-674
Description: CWE-674: Uncontrolled Recursion
Metrics
VersionBase scoreBase severityVector
3.17.5HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Version: 3.1
Base score: 7.5
Base severity: HIGH
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
https://github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548
x_refsource_CONFIRM
https://github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0
x_refsource_MISC
https://github.com/harttle/liquidjs/releases/tag/v10.25.7
x_refsource_MISC
Hyperlink: https://github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548
Resource:
x_refsource_CONFIRM
Hyperlink: https://github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0
Resource:
x_refsource_MISC
Hyperlink: https://github.com/harttle/liquidjs/releases/tag/v10.25.7
Resource:
x_refsource_MISC
Details not found