LiquidJS, a JavaScript template engine compatible with Shopify and GitHub Pages, contained an uncontrolled recursion vulnerability (CWE-674) in versions before 10.25.7. Specifically, circular references in {% layout %} and {% block %} constructs cause infinite recursive loops, consuming approximately 4GB of memory and causing the Node.js process to crash with a fatal heap out of memory error. This vulnerability allows unauthenticated users who can submit Liquid templates to trigger a denial of service. The vulnerability is tracked as CVE-2026-41311 with a CVSS 3.1 base score of 7.5 (high severity). The issue is fixed in version 10.25.7.

Exploitation results in a denial of service by crashing the Node.js process due to heap memory exhaustion. There is no impact on confidentiality or integrity. The attack requires the ability to submit crafted Liquid templates, which could be possible in environments where user input is rendered using vulnerable LiquidJS versions.

A fix is available in LiquidJS version 10.25.7. Users and administrators should upgrade to version 10.25.7 or later to remediate this vulnerability. Since this is a self-hosted library, patching the dependency in affected applications is required. No other mitigations are indicated.