{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/liquidjs--10.27.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"id":"CVE-2026-55575"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["LiquidJS (\u003c= 10.27.0)"],"_cs_severities":["medium"],"_cs_tags":["liquidjs","denial-of-service","vulnerability","memory-exhaustion","nodejs"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eA critical vulnerability, tracked as CVE-2026-55575, has been identified in the LiquidJS templating library, affecting all versions up to and including 10.27.0. The \u003ccode\u003epop\u003c/code\u003e array filter, located at \u003ccode\u003esrc/filters/array.ts:91-95\u003c/code\u003e, fails to properly account for memory allocations against the configured \u003ccode\u003ememoryLimit\u003c/code\u003e setting. Unlike its sibling array filters, \u003ccode\u003epop\u003c/code\u003e creates an O(N) clone of an input array without deducting its size from the memory budget. This oversight allows an attacker to bypass the intended memory limits by crafting templates that apply the \u003ccode\u003e| pop\u003c/code\u003e filter to large, attacker-influenced arrays. Consequently, a single \u003ccode\u003erender()\u003c/code\u003e call can consume substantial amounts of memory, potentially leading to denial of service (DoS) through memory exhaustion. This is particularly dangerous in multi-tenant environments where \u003ccode\u003ememoryLimit\u003c/code\u003e is relied upon as a critical DoS guard against untrusted template inputs, such as those derived from user-generated content or large data sets. The vulnerability directly undermines the library's built-in resource protection mechanisms.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker identifies a web application or service that utilizes the LiquidJS templating library, specifically versions up to and including 10.27.0.\u003c/li\u003e\n\u003cli\u003eThe application allows attacker-influenced input, such as query parameters or API payloads, to be processed as a large array within a LiquidJS template context.\u003c/li\u003e\n\u003cli\u003eThe attacker crafts a malicious template or injects template code that applies the \u003ccode\u003e| pop\u003c/code\u003e filter to this large, untrusted array (e.g., \u003ccode\u003e{{ untrusted_array | pop }}\u003c/code\u003e).\u003c/li\u003e\n\u003cli\u003eWhen the LiquidJS engine processes this template, the vulnerable \u003ccode\u003epop\u003c/code\u003e filter creates a full O(N) clone of the large input array in memory.\u003c/li\u003e\n\u003cli\u003eDue to the vulnerability (CVE-2026-55575), this significant memory allocation is not accounted for against the application's configured \u003ccode\u003ememoryLimit\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eThe application continues to allocate memory unchecked, consuming Node.js process heap space.\u003c/li\u003e\n\u003cli\u003eThis excessive memory consumption eventually leads to the exhaustion of the Node.js process's available memory or triggers a system-level Out-Of-Memory (OOM) killer.\u003c/li\u003e\n\u003cli\u003eThe final objective is achieved: a denial of service for the affected LiquidJS application instance or the host system.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability renders the \u003ccode\u003ememoryLimit\u003c/code\u003e guard ineffective for templates utilizing the \u003ccode\u003epop\u003c/code\u003e filter, allowing uncontrolled O(N) memory allocation when processing large, attacker-influenced arrays. This directly enables a denial of service (DoS) attack through memory exhaustion. A single template render can allocate hundreds of megabytes of array slots, circumventing the intended memory budget. In scenarios with concurrent requests, this effect is amplified, rapidly consuming the Node.js process heap and potentially leading to \u003ccode\u003eoom-kill\u003c/code\u003e events on the host system. This is a critical bypass of a documented DoS protection mechanism, especially concerning for multi-tenant applications that rely on \u003ccode\u003ememoryLimit\u003c/code\u003e to constrain resource usage from untrusted template inputs like search results, paginated lists, or user data.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003eliquidjs\u003c/code\u003e package to a version where CVE-2026-55575 has been resolved to mitigate this memory limit bypass.\u003c/li\u003e\n\u003cli\u003eReview LiquidJS templates for any usage of the \u003ccode\u003e| pop\u003c/code\u003e filter on arrays derived from untrusted input; consider replacing it with guarded alternatives like \u003ccode\u003e| slice: 0, arr.size | minus: 1\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement the provided workaround by registering a custom \u003ccode\u003epop\u003c/code\u003e filter in LiquidJS that explicitly includes \u003ccode\u003ethis.context.memoryLimit.use(arr.length)\u003c/code\u003e accounting for array allocations to re-establish the memory budget.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T14:16:34Z","date_published":"2026-07-24T14:16:34Z","id":"https://feed.craftedsignal.io/briefs/2026-07-liquidjs-pop-filter-bypass/","summary":"A vulnerability (CVE-2026-55575) in the LiquidJS templating library's `pop` filter, affecting versions up to and including 10.27.0, allows an attacker to bypass the `memoryLimit` accounting, leading to uncontrolled memory allocation and potential denial of service when processing untrusted, large arrays in templates.","title":"LiquidJS pop Filter Bypasses Memory Limit Accounting","url":"https://feed.craftedsignal.io/briefs/2026-07-liquidjs-pop-filter-bypass/"}],"language":"en","title":"CraftedSignal Threat Feed - LiquidJS (\u003c= 10.27.0)","version":"https://jsonfeed.org/version/1.1"}