LiquidJS versions prior to 10.26.0 contain a vulnerability in the `date` filter's strftime implementation that allows unbounded width padding. This flaw bypasses the engine's memory and render limits by passing unchecked large width specifiers to a padding function, causing excessive memory allocation and CPU usage. An attacker can exploit this by supplying a crafted date format string, leading to denial of service via high resource consumption or process crash due to out-of-memory conditions. The vulnerability is fixed in version 10.26.0.