7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45617

CVE-2026-45617: LiquidJS: ReDoS via Quadratic Backtracking in `strip_html` Filter Regex

LiquidJS is a Shopify/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the built-in strip_html filter uses a regex containing four flawed lazy-quantified alternatives, leading to ReDoS via quadratic backtracking. When the input contains many <script, <style, or <!-- opener tokens without matching closers, the V8 regex engine performs O(N²) backtracking, blocking the Node.js event loop. A single ~350 KB request ('<script'.repeat(50000)) stalls the process for ~10 seconds; cost grows quadratically with input size. The default memoryLimit: Infinity does not bound regex CPU, and even when configured strip_html only charges str.length to the limit — the regex itself runs unbounded. A single unauthenticated request containing crafted untrusted input can cause severe event-loop blocking and CPU amplification that saturates Node.js workers while bypassing memoryLimit protections. This issue has been fixed in version 10.26.0.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45617

CVE-2026-45617:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
liquidjs	npm	< 10.26.0	10.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a Regular Expression Denial of Service (ReDoS) located in the strip_html filter of the LiquidJS library, as detailed in the security advisory. The function, found in src/filters/html.ts, originally used the regex /<script[\s\S]*?<\/script>|<style[\s\S]*?<\/style>|<.*?>|/g to remove HTML tags. The use of multiple lazy quantifiers (*?) in this expression leads to catastrophic backtracking when processing specially crafted input, such as a long string of unclosed <script tags. This causes the CPU to work in quadratic time relative to the input length, effectively blocking the Node.js event loop and making the application unresponsive. The fixing commit 3616a744b9abeb425c217b340a2397d46176afb8 confirms this by completely removing the vulnerable regex-based implementation and replacing it with a linear-time, single-pass string scanning algorithm using indexOf. During an exploit, the strip_html function would be the primary consumer of CPU time and would be the key indicator in any runtime profile or stack trace.

Vulnerable functions

strip_html

src/filters/html.ts

The `strip_html` function is vulnerable to Regular Expression Denial of Service (ReDoS). It uses a regex with multiple lazy quantifiers that performs catastrophic backtracking when processing strings with many unclosed tags like `<script` or `<style`. This leads to quadratic complexity, causing the Node.js event loop to stall and resulting in a denial of service.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.