In handlebars.js versions 4.0.0 to 4.7.8, templates containing decorator syntax referencing unregistered decorators cause the compiled template to call lookupProperty on the decorators object, returning undefined. The runtime then tries to invoke this undefined value as a function, resulting in an unhandled TypeError that crashes the Node.js process. This vulnerability leads to a denial of service if user-supplied templates are compiled without try/catch error handling. The issue is fixed in version 4.7.9. Workarounds include error handling during compilation and rendering, input validation to reject decorator syntax, or using pre-compiled templates to avoid runtime compilation.

Exploitation of this vulnerability results in a denial of service by crashing the Node.js process running the handlebars.js template engine. There is no impact on confidentiality or integrity, but availability is affected due to process termination. The vulnerability can be triggered remotely if user-supplied templates are compiled without error handling.

A fix is available in handlebars.js version 4.7.9. Users should upgrade to this version to remediate the vulnerability. If upgrading is not immediately possible, mitigate by wrapping template compilation and rendering calls in try/catch blocks to handle exceptions gracefully. Additionally, validate template inputs to reject any containing decorator syntax ({{*...}}) if decorators are not used. Alternatively, use the pre-compilation workflow to compile templates at build time and serve only pre-compiled templates, avoiding runtime compilation of user input.