7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41311

CVE-2026-41311: LiquidJS is vulnerable to Denial of Service via circular block reference in layout

LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to version 10.25.7, a circular block reference in {% layout %} / {% block %} causes an infinite recursive loop, consuming all available memory (~4GB) and crashing the Node.js process with FATAL ERROR: JavaScript heap out of memory. This allows any user who can submit a Liquid template to perform a Denial of Service attack. This issue has been patched in version 10.25.7.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41311

CVE-2026-41311:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
liquidjs	npm	< 10.25.7	10.25.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the handling of nested {% block %} tags with the same name within a {% layout %} structure in the liquidjs library. The root cause is an uncontrolled recursion.

When a template contains a block nested inside another block of the same name (e.g., {% block a %}{% block a %}{% endblock %}{% endblock %}), the rendering process enters an infinite loop. This occurs in the Block.getBlockRender function located in src/tags/block.ts.

The vulnerable logic works as follows: when rendering the inner block, the getBlockRender function looks up the render function for that block name. It finds the render function of the outer block and calls it. This re-renders the content of the outer block, which includes the inner block, causing the process to repeat indefinitely.

This infinite recursion rapidly consumes system memory, leading to a JavaScript heap out of memory error that crashes the Node.js process, resulting in a Denial of Service (DoS). Any user with permission to submit Liquid templates can trigger this vulnerability.

The patch addresses this by introducing a blockStack in the rendering context. Before a block is rendered, it's pushed onto the stack. A check is added to ensure a block is not already on the stack before rendering, effectively breaking the infinite loop by throwing a 'block tag cannot be nested' error if a circular reference is detected.

Vulnerable functions

Block.render

src/tags/block.ts

This function is the main rendering method for a `block` tag. It calls the `getBlockRender` method to get the rendering function. In a vulnerable scenario, this leads to the execution of code that can enter an infinite recursive loop when a block is nested within another block of the same name.

Block.getBlockRender

src/tags/block.ts

This private method contains the core of the vulnerability. It's responsible for looking up the render function for a given block. Before the patch, when a nested block with the same name as its parent was encountered, this function would retrieve the parent's render function and call it, initiating an infinite recursion. The fix adds a check using a `blockStack` to detect and throw an error on such recursive calls, preventing the denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.