CVE-2026-45357: CWE-400: Uncontrolled Resource Consumption in harttle liquidjs
CVE-2026-45357 is a high-severity vulnerability in harttle liquidjs, a JavaScript template engine. Versions 10.25.7 and below have an uncontrolled resource consumption issue in the date filter's strftime implementation. Specifically, large width specifiers like %9999999d cause unbounded string padding operations that bypass memory and render limits, leading to excessive memory use and CPU consumption. This can result in denial-of-service conditions such as out-of-memory crashes during template rendering. The issue is fixed in version 10.26.0.
AI Analysis
Technical Summary
In harttle liquidjs versions 10.25.7 and earlier, the date filter's strftime implementation improperly handles large width specifiers (e.g., %9999999d). These specifiers are passed unchecked into pad()/padStart() functions, which perform unbounded string concatenation loops without respecting the Context's memoryLimit or renderLimit settings. This allows a crafted template to generate megabytes of output and consume excessive CPU, bypassing advertised DoS protections. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and can cause high memory usage, CPU exhaustion, or out-of-memory crashes during rendering. The issue has been resolved in version 10.26.0.
Potential Impact
Exploitation of this vulnerability can cause denial-of-service conditions by consuming excessive memory and CPU resources during template rendering. This can lead to application crashes or degraded performance, impacting availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available in harttle liquidjs version 10.26.0. Users should upgrade to version 10.26.0 or later to remediate this vulnerability. Until upgraded, be cautious with untrusted template inputs that use the date filter with strftime width specifiers. Patch status is confirmed by the vendor stating the issue is fixed in 10.26.0.
CVE-2026-45357: CWE-400: Uncontrolled Resource Consumption in harttle liquidjs
Description
CVE-2026-45357 is a high-severity vulnerability in harttle liquidjs, a JavaScript template engine. Versions 10.25.7 and below have an uncontrolled resource consumption issue in the date filter's strftime implementation. Specifically, large width specifiers like %9999999d cause unbounded string padding operations that bypass memory and render limits, leading to excessive memory use and CPU consumption. This can result in denial-of-service conditions such as out-of-memory crashes during template rendering. The issue is fixed in version 10.26.0.
CVSS v3.1
Score 7.5high
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
In harttle liquidjs versions 10.25.7 and earlier, the date filter's strftime implementation improperly handles large width specifiers (e.g., %9999999d). These specifiers are passed unchecked into pad()/padStart() functions, which perform unbounded string concatenation loops without respecting the Context's memoryLimit or renderLimit settings. This allows a crafted template to generate megabytes of output and consume excessive CPU, bypassing advertised DoS protections. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption) and can cause high memory usage, CPU exhaustion, or out-of-memory crashes during rendering. The issue has been resolved in version 10.26.0.
Potential Impact
Exploitation of this vulnerability can cause denial-of-service conditions by consuming excessive memory and CPU resources during template rendering. This can lead to application crashes or degraded performance, impacting availability. There is no impact on confidentiality or integrity reported.
Mitigation Recommendations
A fix is available in harttle liquidjs version 10.26.0. Users should upgrade to version 10.26.0 or later to remediate this vulnerability. Until upgraded, be cautious with untrusted template inputs that use the date filter with strftime width specifiers. Patch status is confirmed by the vendor stating the issue is fixed in 10.26.0.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-05-11T21:40:08.179Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a332ba8f198dc38c12b61b5
Added to database: 06/17/2026, 23:20:08 UTC
Last enriched: 07/10/2026, 09:51:35 UTC
Last updated: 07/14/2026, 07:47:30 UTC
Views: 59
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.