CVE-2026-33287: LiquidJS has Exponential Memory Amplification through its replace_first Filter $& Pattern
(updated )
The replace_first filter in LiquidJS uses JavaScript’s String.prototype.replace() which interprets $& as a backreference to the matched substring. The filter only charges memoryLimit for the input string length, not the amplified output. An attacker can achieve exponential memory amplification (up to 625,000:1) while staying within the memoryLimit budget, leading to denial of service.
References
- github.com/advisories/GHSA-6q5m-63h6-5x4v
- github.com/harttle/liquidjs/blob/v10.25.1/CHANGELOG.md
- github.com/harttle/liquidjs/commit/35d523026345d80458df24c72e653db78b5d061d
- github.com/harttle/liquidjs/releases/tag/v10.25.1
- github.com/harttle/liquidjs/security/advisories/GHSA-6q5m-63h6-5x4v
- nvd.nist.gov/vuln/detail/CVE-2026-33287
Code Behaviors & Features
Detect and mitigate CVE-2026-33287 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →