In Handlebars.js versions 4.0.0 through 4.7.8, when a template includes decorator syntax referencing an unregistered decorator (e.g., {{*n}}), the compiled template calls lookupProperty(decorators, "n"), which returns undefined. The runtime then attempts to invoke this undefined value as a function, causing an unhandled TypeError that crashes the Node.js process. This vulnerability allows an attacker to cause a denial of service by submitting a malicious template that triggers the crash. The issue is fixed in version 4.7.9. Mitigations include wrapping compilation and rendering calls in try/catch blocks, validating templates to reject decorator syntax if decorators are not used, or using a pre-compilation workflow to avoid runtime compilation of user-supplied templates.

The vulnerability causes a denial of service by crashing the Node.js process when an unregistered decorator is invoked in a template. This impacts availability of applications that compile user-supplied Handlebars templates without proper error handling. There is no impact on confidentiality or integrity reported. The CVSS 3.1 score is 7.5 (High), reflecting network attack vector, low complexity, no privileges required, no user interaction, and impact limited to availability.

A fix is available in Handlebars.js version 4.7.9. Users should upgrade to this version to resolve the vulnerability. Until upgrading, applications should wrap template compilation and rendering calls in try/catch blocks to handle potential exceptions. Additionally, validate templates before compilation to reject those containing decorator syntax if decorators are not used. Alternatively, use a pre-compilation workflow to compile templates at build time and serve only pre-compiled templates, avoiding runtime compilation of user-supplied templates.