CVE-2026-41311: 
JavaScript vulnerability analysis and mitigation

CVE-2026-41311 is a Denial of Service vulnerability in LiquidJS, a Shopify/GitHub Pages compatible Liquid template engine for Node.js, caused by uncontrolled recursion when processing circular block references in {% layout %} / {% block %} tags. All versions prior to 10.25.7 are affected. The vulnerability was discovered by researcher 1netvn, published to the GitHub Advisory Database on April 24, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) by the GitHub Advisory Database, or 6.5 (Medium) per Feedly's assessment (Github Advisory, LiquidJS Advisory).

The root cause is CWE-674 (Uncontrolled Recursion) in src/tags/block.ts within the getBlockRender method. During OUTPUT mode, each block looks up its render function from ctx.getRegister('blocks')[this.block]. When a block with a given name (e.g., a) is nested inside another block with the same name in a child template, the inner block resolves to the outer block's render function and calls it; the outer block's templates then contain the inner block again, creating an infinite recursive loop with no termination condition. This consumes all available heap memory (~4GB) and crashes the Node.js process with FATAL ERROR: JavaScript heap out of memory. The fix, introduced in commit e2311df, adds a blockStack register that tracks active block tags and throws an error (block tag cannot be nested) if the same tag instance is encountered again during rendering (LiquidJS Advisory, Fix Commit).

Successful exploitation causes complete availability loss of the Node.js process hosting the LiquidJS template engine — the OS kills the process due to memory exhaustion, resulting in full service disruption. There is no confidentiality or integrity impact. Applications at risk include CMS platforms, email template builders, multi-tenant SaaS products, and static site generators that accept user-provided or user-influenced Liquid templates; a single malicious template submission is sufficient to crash the service (Github Advisory).

A working proof-of-concept is publicly available in the GitHub Security Advisory and requires only a few lines of Liquid template markup and JavaScript to trigger (LiquidJS Advisory). The EPSS score is approximately 0.038–0.051% (16th percentile), indicating low but non-zero exploitation probability in the near term. No in-the-wild exploitation or threat actor attribution has been reported, and the vulnerability is not listed in the CISA KEV catalog. The attack requires low privileges (the ability to submit a template) per Feedly's assessment, though the GitHub Advisory rates it as requiring no privileges at all (Github Advisory).

1. Identify a target: Find an application that uses LiquidJS (versions < 10.25.7) and allows users to submit or influence Liquid templates — such as a CMS, email builder, or SaaS platform.
2. Create a layout file (layout.html) on the server (or identify an existing one):

{% block a %}default-a{% endblock %}
{% block b %}default-b{% endblock %}
{% block c %}default-c{% endblock %}

3. Submit a malicious child template that references the layout and nests a same-named block within itself:

{% layout "layout" %}
{% block a %}outer-a {% block a %}inner-a{% endblock %}{% endblock %}
{% block b %}content-b{% endblock %}
{% block c %}content-c{% endblock %}

4. Alternatively, use the anonymous block variant (no layout file needed beyond a parent with a block):

{% layout "parent" %}
{%block%}A{%block%}B{%endblock%}{%endblock%}

5. Trigger rendering: Submit the template through the application's template rendering endpoint. The Node.js process will enter an infinite recursive loop, memory will grow to ~4GB, and the process will crash with FATAL ERROR: JavaScript heap out of memory, causing a complete denial of service (LiquidJS Advisory).

• Logs: Node.js process logs showing FATAL ERROR: CALL_AND_RETRY_LAST Allocation failed - JavaScript heap out of memory or FATAL ERROR: JavaScript heap out of memory immediately after a template rendering request.
• Process: Sudden termination of the Node.js process hosting LiquidJS; abnormal memory growth (approaching system limits) observable via process monitors (e.g., top, htop, APM tools) correlated with a template render request.
• Application Logs: HTTP requests to template submission or rendering endpoints containing {% layout %} and nested {% block %} tags with identical block names, or anonymous nested {%block%} tags.
• Network: Repeated requests to template rendering endpoints from the same source IP, potentially indicating automated DoS attempts (LiquidJS Advisory).

Upgrade LiquidJS to version 10.25.7 or later, which introduces a blockStack guard that detects and rejects circular/nested same-name block references with an error rather than entering infinite recursion (LiquidJS Release, Fix Commit). As a workaround prior to patching, restrict or sanitize user-submitted templates to disallow nested {% block %} tags with the same name, or disable user-controlled template rendering entirely. Running the Node.js process with a reduced heap size limit (--max-old-space-size) can limit the blast radius but will not prevent the crash.

The vulnerability was reported by researcher 1netvn and promptly addressed by the LiquidJS maintainer (harttle) with a patch released the same day as the advisory (April 23, 2026). No significant broader media coverage or notable public researcher commentary beyond the advisory itself has been identified (LiquidJS Advisory).