CVE-2026-34166: 
JavaScript vulnerability analysis and mitigation

CVE-2026-34166 is a memory limit bypass vulnerability in LiquidJS caused by quadratic amplification in the replace filter. When the memoryLimit option is enabled, the filter incorrectly charges only the sum of input lengths (str.length + pattern.length + replacement.length) to the memory limiter, while the actual output of str.split(pattern).join(replacement) can be orders of magnitude larger. This affects all LiquidJS (npm) versions up to and including 10.25.2, with version 10.25.3 containing the fix. The vulnerability was published on April 8, 2026, and carries a CVSS v3.1 base score of 3.7 (Low) per the GitHub Advisory, though NVD scores it at 5.3 (Medium) (Github Advisory, LiquidJS Advisory).

The root cause is CWE-400 (Uncontrolled Resource Consumption) in src/filters/string.ts at lines 137–142. The memoryLimit.use() call accounts only for the three input string lengths, but the actual output size is (number_of_occurrences × replacement.length) + non_matching_characters — a quadratic relationship when the pattern appears many times. For example, a 5,000-character string where every character matches the pattern, combined with a 5,000-character replacement, produces 25,000,000 characters of output while only 10,001 bytes are charged to the limiter — approximately 2,500x amplification. The Limiter class (src/util/limiter.ts) is a simple accumulator with no post-hoc validation of actual allocated memory, so the check is bypassed entirely. Exploitation requires an attacker to have template authoring access on a deployment where memoryLimit is explicitly configured (it defaults to Infinity) (LiquidJS Advisory, Fix Commit).

The impact is limited to availability — there is no confidentiality or integrity impact. A successful exploit causes the Node.js process to consume far more memory than the configured memoryLimit allows, potentially leading to out-of-memory crashes, denial of service for co-tenant users sharing the same process, and resource exhaustion on the hosting infrastructure. This is most severe in multi-tenant SaaS environments where users can author custom Liquid templates and the operator has enabled memoryLimit as a DoS protection measure (Github Advisory).

A proof-of-concept exploit is publicly available in the GitHub Security Advisory, demonstrating the ~2,500x memory amplification with runnable JavaScript code. There is no evidence of in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.023% (7th percentile), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires the non-default memoryLimit configuration to be enabled and the attacker to have template authoring access, which limits the attack surface (LiquidJS Advisory, Github Advisory).

1. Identify target: Locate a deployment of LiquidJS (npm package, version ≤ 10.25.2) where the memoryLimit option is explicitly configured and users can author or inject template content (e.g., a multi-tenant SaaS platform with custom template support).
2. Craft malicious template: Construct a Liquid template that assigns a large string of repeated characters as the input (s) and a large replacement string (r), then applies the replace filter — for example:

   {%- assign s = "aaaa..." -%}  {# 5,000 'a' characters #}
   {%- assign r = "bbbb..." -%}  {# 5,000 'b' characters #}
   {{ s | replace: "a", r }}

3. Submit template: Submit the crafted template through the application's template authoring interface or API endpoint.
4. Trigger rendering: Cause the server to render the template. The replace filter charges only ~10,001 bytes to the memory limiter but produces ~25,000,000 bytes of output, bypassing the configured limit.
5. Achieve DoS: The Node.js process exhausts available memory, causing an out-of-memory crash or severe degradation, resulting in denial of service for all users on the affected process (LiquidJS Advisory).

• Logs: Node.js process crash logs or FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory messages in application logs; repeated template rendering requests containing large assign blocks with replace filter usage.
• Process: Sudden spike in Node.js heap memory consumption immediately preceding a process crash or OOM kill event; abnormally large string allocations visible in heap dumps.
• Network: Repeated HTTP requests to template rendering endpoints with unusually large request bodies containing Liquid template syntax (e.g., assign, replace filter patterns with long repeated character strings) (LiquidJS Advisory).

Upgrade LiquidJS to version 10.25.3 or later, which fixes the issue by computing the exact output size (str.length + (parts.length - 1) * (replacement.length - pattern.length)) before charging the memory limiter (LiquidJS Release, Fix Commit). For deployments that cannot upgrade immediately, consider restricting or disabling the replace filter in untrusted templates, implementing OS-level memory limits (e.g., container memory limits) as a secondary control, or running LiquidJS template rendering in isolated worker processes with strict resource constraints (Github Advisory).