6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44645

CVE-2026-44645: LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the renderLimit option can be fully bypassed by a {% for %} (or {% tablerow %}) tag whose body is empty. The renderLimit option is documented in docs/source/tutorials/dos.md as the mechanism that "mitigates this by limiting the time consumed by each render() call." The per-iteration time check is reached only when the body contains at least one template node, so a template such as {%- for i in (1..N) -%}{%- endfor -%} iterates the full collection without ever consulting renderLimit. With a configured renderLimit of 50 ms, a single parseAndRenderSync call has been observed to consume 2.26 seconds (~45× over the limit) and scales linearly with N up to memoryLimit, allowing a low-privileged template author to wedge an event-loop thread for an attacker-chosen duration. Deployments that rely on a finite renderLimit for DoS protection (common in multi-tenant template-authoring environments) can still be forced by a single crafted template to monopolize a Node.js event-loop worker for attacker-controlled time, potentially stalling in-flight requests, with availability impact only. This issue has been fixed in version 10.26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-44645

CVE-2026-44645:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable NoTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
liquidjs	npm	<= 10.25.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service (DoS) in LiquidJS's template rendering engine. The renderLimit feature, designed to prevent resource exhaustion from long-running templates, could be bypassed. The root cause was in the Render.renderTemplates function, where the time limit check was located inside a loop that processed template elements. If a template tag with an iterable body, such as {% for %} or {% tablerow %}, was used with an empty body, the renderTemplates function was called repeatedly with an empty list of templates. This caused the time limit check to be skipped entirely, allowing a template to consume CPU resources for an attacker-controlled duration, far exceeding the configured renderLimit. The fix involves moving the time limit check to the beginning of the renderTemplates function, ensuring it is executed on every invocation, regardless of whether the template body is empty or not.

Vulnerable functions

Render.renderTemplates

src/render/render.ts

The `renderLimit` check was only performed inside a loop that iterates over template nodes. If a tag like `{% for %}` had an empty body, the `templates` array passed to this function would be empty. This caused the loop to be skipped, and therefore the `renderLimit` check was bypassed, allowing an attacker to cause a denial of service by making the loop in the calling tag (e.g., `For.render`) run for an extended period.

For.render

src/tags/for.ts

This function implements the `for` tag. It iterates over a collection and calls `renderTemplates` for each item. When the `for` tag has an empty body in the template, `this.templates` is an empty array. This triggers the vulnerability in `Render.renderTemplates`, causing a tight loop without any time limit checks, leading to a denial of service.

Tablerow.render

src/tags/tablerow.ts

This function implements the `tablerow` tag. Similar to the `for` tag, it iterates and calls `renderTemplates`. When the `tablerow` tag has an empty body, it triggers the vulnerability in `Render.renderTemplates` by calling it in a loop with an empty `templates` array, leading to a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.