CVE-2026-33939: 
Grafana vulnerability analysis and mitigation

CVE-2026-33939 is a Denial of Service vulnerability in Handlebars.js caused by malformed decorator syntax in template compilation. When a template containing an unregistered decorator reference (e.g., {{*n}}) is compiled, the runtime attempts to invoke undefined as a function, producing an unhandled TypeError that crashes the Node.js process. It affects Handlebars versions 4.0.0 through 4.7.8 (npm package) and was disclosed on March 26, 2026, with a fix released the same day in version 4.7.9. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, Security Advisory).

The root cause is classified as CWE-754 (Improper Check for Unusual or Exceptional Conditions). In lib/handlebars/compiler/javascript-compiler.js, the code generated for a decorator invocation directly calls the result of lookupProperty(decorators, "n") as a function without first verifying it is defined. When the named decorator is not registered, lookupProperty returns undefined, and the immediate invocation lookupProperty(decorators, "n")(fn, props, container, options) throws a TypeError: lookupProperty(...) is not a function. Unlike unregistered helpers — which produce a clean "Missing helper: ..." error — unregistered decorators cause an unhandled exception that propagates out of the compiled template function and crashes the Node.js process if not caught by the application. The fix in commit 68d8df5 adds a type check before invocation, storing the resolved decorator in a variable and throwing a controlled Error if it is not a function (Security Advisory, Fix Commit).

Successful exploitation results in a complete availability impact — the Node.js process crashes, rendering the affected application unavailable. There is no confidentiality or integrity impact. In environments using process managers such as PM2 or systemd that automatically restart crashed processes, an attacker can submit repeated malicious requests to maintain a persistent Denial of Service condition. Any application that accepts user-supplied Handlebars templates and passes them to Handlebars.compile() at request time without error handling is affected (Github Advisory).

No confirmed in-the-wild exploitation has been observed, and no weaponized exploit code is publicly available — the proof-of-concept published in the security advisory is a local library invocation illustrating the bug rather than an attack tool (Security Advisory). The vulnerability is unauthenticated and requires no user interaction, making it trivially exploitable against any exposed endpoint that compiles user-supplied templates. The EPSS score is approximately 0.038–0.076%, indicating a low current probability of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The vulnerability was reported by trace37labs (Github Advisory).

1. Identify a vulnerable endpoint: Locate a web application that accepts user-supplied Handlebars template strings and passes them directly to Handlebars.compile(userInput)() at request time, without input validation or error handling.
2. Craft the malicious payload: Prepare a template string containing decorator syntax referencing an unregistered decorator, such as {{*n}}, {{*decorator}}, or {{*constructor}}.
3. Submit the payload: Send an HTTP request to the vulnerable endpoint with the crafted template as the input parameter (e.g., via a POST body, query string, or form field).
4. Trigger the crash: The server compiles the template, lookupProperty(decorators, "n") returns undefined, and the runtime immediately attempts to call undefined as a function, throwing an unhandled TypeError that crashes the Node.js process.
5. Sustain the DoS: If the application uses a process manager (PM2, systemd) that auto-restarts on crash, repeat the request after each restart to maintain persistent service unavailability (Security Advisory).

• Logs: Node.js process logs or application error logs containing TypeError: lookupProperty(...) is not a function with a stack trace referencing javascript-compiler.js and an eval context (e.g., at Function.eval [as decorator] (eval at compile (...javascript-compiler.js:134:36))).
• Logs: Repeated application crash/restart events in process manager logs (PM2, systemd journal) correlating with inbound HTTP requests.
• Network: HTTP requests to template-rendering endpoints containing the pattern {{* in request bodies, query parameters, or headers.
• Process: Unexpected Node.js process terminations followed by immediate restarts, particularly when correlated with specific source IPs or request patterns (Security Advisory).

The primary remediation is to upgrade Handlebars to version 4.7.9 or later, which adds a type check before invoking a resolved decorator and throws a controlled error for unregistered decorators (v4.7.9 Release). If immediate upgrade is not possible, the following workarounds can be applied: (1) wrap all calls to Handlebars.compile() and template rendering in try/catch blocks to prevent unhandled exceptions from crashing the process; (2) validate user-supplied template input and reject any templates containing decorator syntax ({{*...}}) if decorators are not used in the application; or (3) adopt a pre-compilation workflow where templates are compiled at build time and only pre-compiled templates are served at runtime, eliminating runtime calls to compile() with user input (Security Advisory). IBM has also issued advisories for affected products including App Connect Enterprise, Business Automation Manager Open Editions, Cloud Pak for Integration, API Connect, Instana, QRadar Suite, and others (IBM App Connect, IBM Cloud Pak Integration).

The vulnerability was reported by trace37labs and published by maintainer jaylinski on March 26, 2026, alongside the patched release v4.7.9 (Security Advisory). IBM issued multiple security bulletins in April–June 2026 for downstream products incorporating the vulnerable Handlebars dependency, including App Connect Enterprise, Business Automation Manager Open Editions, Cloud Pak for AIOps, API Connect, Instana, QRadar Suite, and Business Automation Insights (IBM App Connect). The vulnerability was detected by Nessus (plugin 304155) and multiple Qualys detection IDs, indicating broad scanner coverage.