Skip to content
Threat Feed
Subscribe

Product

LiquidJS (<= 10.27.0)

1 brief RSS
medium advisory

LiquidJS pop Filter Bypasses Memory Limit Accounting

A vulnerability (CVE-2026-55575) in the LiquidJS templating library's `pop` filter, affecting versions up to and including 10.27.0, allows an attacker to bypass the `memoryLimit` accounting, leading to uncontrolled memory allocation and potential denial of service when processing untrusted, large arrays in templates.

LiquidJS denial-of-service vulnerability memory-exhaustion nodejs
1t 1c