LiquidJS, a JavaScript template engine, has a ReDoS vulnerability (CWE-1333) in versions 10.25.7 and earlier. The built-in strip_html filter uses a regex with four flawed lazy-quantified alternatives, causing quadratic backtracking in the V8 regex engine when processing inputs with many unclosed <script, <style, or <!-- tokens. This results in O(N²) complexity, blocking the Node.js event loop and causing CPU amplification. The default memoryLimit setting does not limit regex CPU usage, allowing an attacker to stall the process with crafted input. The vulnerability can be exploited by a single unauthenticated request. The issue is resolved in version 10.26.0.

An unauthenticated attacker can send specially crafted input to trigger the inefficient regex in the strip_html filter, causing the Node.js event loop to block for several seconds and saturate CPU resources. This leads to denial of service by making the application unresponsive. Memory limits do not mitigate the CPU exhaustion caused by the regex backtracking. The impact is high availability disruption without direct confidentiality or integrity loss.

Upgrade to LiquidJS version 10.26.0 or later where this vulnerability is fixed. Until then, avoid processing untrusted input with the strip_html filter or implement external request rate limiting to reduce exposure. Patch status is not explicitly confirmed in the vendor advisory, but the fix is stated to be in version 10.26.0.