The LiquidJS template engine (versions 10.25.7 and earlier) includes a strip_html filter that uses a regular expression with four flawed lazy-quantified alternatives. When processing crafted input containing numerous unmatched <script, <style, or <!-- tokens, the V8 regex engine performs quadratic backtracking, resulting in O(N²) complexity. This causes severe event-loop blocking and CPU saturation in Node.js, effectively enabling a ReDoS attack. The default memoryLimit setting does not limit CPU usage caused by the regex. This vulnerability allows an unauthenticated attacker to cause denial of service by sending a single large crafted request. The issue is resolved in LiquidJS version 10.26.0.

An unauthenticated attacker can cause a denial of service by sending specially crafted input that triggers quadratic regex backtracking in the strip_html filter. This stalls the Node.js event loop for several seconds and saturates CPU resources, potentially impacting availability of services using vulnerable LiquidJS versions. No confidentiality or integrity impacts are reported.

Upgrade LiquidJS to version 10.26.0 or later, where this vulnerability has been fixed. Until upgraded, be aware that the default memoryLimit setting does not prevent CPU exhaustion from this regex issue. No other mitigations are specified.