6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-44645

CVE-2026-44645: LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

Summary

The renderLimit option — documented in docs/source/tutorials/dos.md as the mechanism that "mitigates this by limiting the time consumed by each render() call" — can be fully bypassed by a {% for %} (or {% tablerow %}) tag whose body is empty. The per-iteration time check is reached only when the body contains at least one template node, so a template like {%- for i in (1..N) -%}{%- endfor -%} iterates the full collection without ever consulting renderLimit. With a configured renderLimit of 50 ms, a single parseAndRenderSync call has been observed to consume 2.26 seconds (~45× over the limit) and scales linearly with N up to memoryLimit, allowing a low-privileged template author to wedge an event-loop thread for an attacker-chosen duration.

Details

Render.renderTemplates is the single point at which renderLimit is consulted:

// src/render/render.ts
14:  public * renderTemplates (templates: Template[], ctx: Context, emitter?: Emitter): IterableIterator<any> {
15:    if (!emitter) {
16:      emitter = ctx.opts.keepOutputType ? new KeepingTypeEmitter() : new SimpleEmitter()
17:    }
18:    const errors = []
19:    for (const tpl of templates) {
20:      ctx.renderLimit.check(getPerformance().now())
21:      try {
22:        const html = yield tpl.render(ctx, emitter)
...
32:    }

The check at line 20 lives inside the for (const tpl of templates) body. When templates.length === 0, the loop body never executes, so the limiter is never consulted on that invocation.

The for tag re-enters renderTemplates once per collection item with no independent time check:

// src/tags/for.ts
70:    for (const item of collection) {
71:      scope[this.variable] = item
72:      ctx.continueCalled = ctx.breakCalled = false
73:      yield r.renderTemplates(this.templates, ctx, emitter)
74:      if (ctx.breakCalled) break
75:      scope.forloop.next()
76:    }

Miggo Vulnerability Database

→

CVE-2026-44645

CVE-2026-44645:

6.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
liquidjs	npm	<= 10.25.7

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a denial-of-service (DoS) in LiquidJS's template rendering engine. The renderLimit feature, designed to prevent resource exhaustion from long-running templates, could be bypassed. The root cause was in the Render.renderTemplates function, where the time limit check was located inside a loop that processed template elements. If a template tag with an iterable body, such as {% for %} or {% tablerow %}, was used with an empty body, the renderTemplates function was called repeatedly with an empty list of templates. This caused the time limit check to be skipped entirely, allowing a template to consume CPU resources for an attacker-controlled duration, far exceeding the configured renderLimit. The fix involves moving the time limit check to the beginning of the renderTemplates function, ensuring it is executed on every invocation, regardless of whether the template body is empty or not.

Vulnerable functions

Render.renderTemplates

src/render/render.ts

The `renderLimit` check was only performed inside a loop that iterates over template nodes. If a tag like `{% for %}` had an empty body, the `templates` array passed to this function would be empty. This caused the loop to be skipped, and therefore the `renderLimit` check was bypassed, allowing an attacker to cause a denial of service by making the loop in the calling tag (e.g., `For.render`) run for an extended period.

For.render

src/tags/for.ts

This function implements the `for` tag. It iterates over a collection and calls `renderTemplates` for each item. When the `for` tag has an empty body in the template, `this.templates` is an empty array. This triggers the vulnerability in `Render.renderTemplates`, causing a tight loop without any time limit checks, leading to a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44645: LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

Summary

Details

CVE-2026-44645:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

6.5

6.5

Basic Information

Basic Information

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-44645: LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

Summary

Details

PoC

Impact

Recommended Fix

Technical Details

6.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-44645: LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

Summary

Details

CVE-2026-44645:

6.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

6.5

6.5

Basic Information

Basic Information

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

CVE-2026-44645: LiquidJS has a renderLimit DoS guard bypass via empty `{% for %}` body

Summary

Details

PoC

Impact

Recommended Fix

Technical Details

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI