CVE-2026-69222: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
The join filter (src/filters/array.ts:8-13) charges memoryLimit by array element count, not by the string length it produces, letting a template bypass a configured memoryLimit and allocate strings far past budget — bounded only by V8/process limits, not by memoryLimit.
References
- github.com/advisories/GHSA-4r6h-5v86-94p3
- github.com/harttle/liquidjs/commit/7ab49f999ac045ec1e87f3a7a9fd68dd9e8602b3
- github.com/harttle/liquidjs/pull/925
- github.com/harttle/liquidjs/releases/tag/v10.27.2
- github.com/harttle/liquidjs/security/advisories/GHSA-4r6h-5v86-94p3
- nvd.nist.gov/vuln/detail/CVE-2026-69222
Code Behaviors & Features
Detect and mitigate CVE-2026-69222 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →