CVE-2026-69222: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process
The join filter (src/filters/array.ts:8-13) charges memoryLimit by array element count, not by the string length it produces, letting a template bypass a configured memoryLimit and allocate strings far past budget — bounded only by V8/process limits, not by memoryLimit.
References
- github.com/advisories/GHSA-4r6h-5v86-94p3
- github.com/harttle/liquidjs/commit/7ab49f999ac045ec1e87f3a7a9fd68dd9e8602b3
- github.com/harttle/liquidjs/pull/925
- github.com/harttle/liquidjs/releases/tag/v10.27.2
- github.com/harttle/liquidjs/security/advisories/GHSA-4r6h-5v86-94p3
- nvd.nist.gov/vuln/detail/CVE-2026-69222
Code Behaviors & Features
Detect and mitigate CVE-2026-69222 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →