LiquidJS versions before 10.25.3 have a vulnerability in the replace filter where memory usage is incorrectly calculated when the memoryLimit option is enabled. The filter charges memory usage based on the lengths of the input string, pattern, and replacement string, but the actual output size from str.split(pattern).join(replacement) can be much larger, especially if the pattern occurs frequently. This discrepancy allows an attacker who can control template content to bypass the memoryLimit protection and cause excessive memory consumption, potentially leading to denial-of-service due to out-of-memory conditions. The issue is tracked as CWE-400 (Uncontrolled Resource Consumption) and is resolved in version 10.25.3.

An attacker able to control template content can exploit this vulnerability to bypass the memoryLimit protection and cause a denial-of-service by consuming excessive memory. This can lead to out-of-memory conditions affecting the availability of applications using vulnerable versions of LiquidJS. There is no impact on confidentiality or integrity. The CVSS score is 3.7 (low severity), reflecting the limited scope and complexity of exploitation.

This vulnerability is fixed in LiquidJS version 10.25.3. Users of LiquidJS should upgrade to version 10.25.3 or later to remediate this issue. Patch status is not explicitly stated in the vendor advisory content provided, but the description confirms the fix is included in version 10.25.3. No other mitigation or temporary workaround is indicated.