CVE-2026-41311: liquidjs has a Denial of Service via circular block reference in layout

April 24, 2026 (updated May 13, 2026)

A circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack.

References

github.com/advisories/GHSA-4rc3-7j7w-m548
github.com/harttle/liquidjs/commit/e2311dfd6e82f73509308aa8a3a1fafc92e226f0
github.com/harttle/liquidjs/releases/tag/v10.25.7
github.com/harttle/liquidjs/security/advisories/GHSA-4rc3-7j7w-m548
nvd.nist.gov/vuln/detail/CVE-2026-41311

Code Behaviors & Features

Detect and mitigate CVE-2026-41311 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →