# liquidjs (npm) vulnerabilities 19 known vulnerabilities (1 critical, 10 high, 7 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 10.30.1 (Oct 28, 2026): no advisory affects it - Newest unaffected release: 10.30.1 (Oct 28, 2026), the latest release - Weekly downloads: 3.4M - Dependents: 1,110 - Releases: 236 since 1.9.1 (Jul 16, 2017) - Registry: https://www.npmjs.com/package/liquidjs - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-106120: 1.9.1 to 10.27.1 (10.27.2 is outside it) - CVE-2026-69222: 1.9.1 to 10.27.1 (10.27.2 is outside it) - CVE-2026-61556: 10.26.0 to 10.27.0 (10.27.1 is outside it) - CVE-2026-45618: 1.9.1 to 10.25.7 (10.26.0 is outside it) - CVE-2026-55575: 1.9.1 to 10.27.0 (10.27.1 is outside it) - CVE-2026-45357: 1.9.1 to 10.25.7 (10.26.0 is outside it) - CVE-2026-44646: 1.9.1 to 10.25.7 (10.26.0 is outside it) - CVE-2026-45617: 1.9.1 to 10.25.7 (10.26.0 is outside it) - CVE-2026-44645: 1.9.1 to 10.25.7 (10.26.0 is outside it) - CVE-2026-44644: 1.9.1 to 10.25.7 (10.26.0 is outside it) - CVE-2026-41311: 1.9.1 to 10.25.6 (10.25.7 is outside it) - CVE-2026-39859: 1.9.1 to 10.25.4 (10.25.5 is outside it) - CVE-2026-39412: 1.9.1 to 10.25.3 (10.25.4 is outside it) - CVE-2026-35525: 1.9.1 to 10.25.2 (10.25.3 is outside it) - CVE-2026-34166: 1.9.1 to 10.25.2 (10.25.3 is outside it) - CVE-2026-33285: 1.9.1 to 10.24.0 (10.25.0 is outside it) - CVE-2026-33287: 1.9.1 to 10.25.0 (10.25.1 is outside it) - CVE-2026-30952: 1.9.1 to 10.24.0 (10.25.0 is outside it) - CVE-2022-25948: 1.9.1 to 9.43.0 (10.0.0 is outside it) ## Advisories (19) ### [CVE-2026-106120](https://cve.now/CVE-2026-106120): LiquidJS: ownPropertyOnly bypass for inherited array indices in first/last/join/reverse/slice/compact, \`.first\`/\`.last\`, negative index, and for-loop iteration - Severity: Medium 6.0 - Published: Oct 6, 2026 - Affected: fixed in 10.27.2. - Fixed in 10.27.2 (released Jul 9, 2026, 89 days before disclosure). - The latest release, 10.30.1, is not affected. - 36% of liquidjs downloads last week were affected versions (1.3M). ### [CVE-2026-69222](https://cve.now/CVE-2026-69222): LiquidJS: Uncontrolled Resource Consumption in \`join\` filter allows template authors to bypass \`memoryLimit\` and crash the process - Severity: High 7.5 - Published: Aug 19, 2026 - Affected: fixed in 10.27.2. - Fixed in 10.27.2 (released Jul 9, 2026, 41 days before disclosure). - The latest release, 10.30.1, is not affected. - 36% of liquidjs downloads last week were affected versions (1.3M). ### [CVE-2026-61556](https://cve.now/CVE-2026-61556): LiquidJS: An infinite loop vulnerability in \`strip\_html\` filter - Severity: High 8.7 - Published: Aug 19, 2026 - Affected: from 10.26.0, fixed in 10.27.1. - Fixed in 10.27.1 (released Jun 23, 2026, 57 days before disclosure). - The latest release, 10.30.1, is not affected. - 6.2% of liquidjs downloads last week were affected versions (229.3K). ### [CVE-2026-45618](https://cve.now/CVE-2026-45618): LiquidJS is Vulnerable to Remote Code Execution - Severity: Critical 10.0 - Published: Aug 11, 2026 - Affected: fixed in 10.26.0. - Fixed in 10.26.0 (released May 14, 2026, 89 days before disclosure). - The latest release, 10.30.1, is not affected. - 26% of liquidjs downloads last week were affected versions (960K). ### [CVE-2026-55575](https://cve.now/CVE-2026-55575): LiquidJS: \`pop\` filter bypasses \`memoryLimit\` accounting that its array-filter siblings enforce - Severity: High 8.2 - Published: Jul 8, 2026 - Affected: fixed in 10.27.1. - Fixed in 10.27.1 (released Jun 23, 2026, 15 days before disclosure). - The latest release, 10.30.1, is not affected. - 32% of liquidjs downloads last week were affected versions (1.2M). ### [CVE-2026-45357](https://cve.now/CVE-2026-45357): LiquidJS: Memory and render limit bypass via unbounded width padding in \`date\` filter (strftime) - Severity: High 7.5 - Published: Jun 17, 2026 - Affected: fixed in 10.26.0. - Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure). - The latest release, 10.30.1, is not affected. - 26% of liquidjs downloads last week were affected versions (960K). ### [CVE-2026-44646](https://cve.now/CVE-2026-44646): LiquidJS: \`{% render %}\` tag silently bypasses per-render \`ownPropertyOnly:true\` via \`Context.spawn()\` - Severity: Medium 5.3 - Published: Jun 17, 2026 - Affected: fixed in 10.26.0. - Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure). - The latest release, 10.30.1, is not affected. - 26% of liquidjs downloads last week were affected versions (960K). ### [CVE-2026-45617](https://cve.now/CVE-2026-45617): LiquidJS: ReDoS via Quadratic Backtracking in \`strip\_html\` Filter Regex - Severity: High 7.5 - Published: Jun 17, 2026 - Affected: fixed in 10.26.0. - Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure). - The latest release, 10.30.1, is not affected. - 26% of liquidjs downloads last week were affected versions (960K). ### [CVE-2026-44645](https://cve.now/CVE-2026-44645): LiquidJS has a renderLimit DoS guard bypass via empty \`{% for %}\` body - Severity: Medium 6.5 - Published: Jun 17, 2026 - Affected: fixed in 10.26.0. - Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure). - The latest release, 10.30.1, is not affected. - 26% of liquidjs downloads last week were affected versions (960K). ### [CVE-2026-44644](https://cve.now/CVE-2026-44644): LiquidJS's strip\_html filter bypass via newline characters in HTML tags enables XSS - Severity: Medium 6.1 - Published: Jun 17, 2026 - Affected: fixed in 10.26.0. - Fixed in 10.26.0 (released May 14, 2026, 34 days before disclosure). - The latest release, 10.30.1, is not affected. - 26% of liquidjs downloads last week were affected versions (960K). ### [CVE-2026-41311](https://cve.now/CVE-2026-41311): LiquidJS is vulnerable to Denial of Service via circular block reference in layout - Severity: High 7.5 - Published: May 9, 2026 - Affected: fixed in 10.25.7. - Fixed in 10.25.7 (released Apr 23, 2026, 16 days before disclosure). - The latest release, 10.30.1, is not affected. - 25% of liquidjs downloads last week were affected versions (913.6K). ### [CVE-2026-39859](https://cve.now/CVE-2026-39859): LiquidJS has a renderFile() / parseFile() bypass configured root and allow arbitrary file read - Severity: Medium 6.3 - Published: Apr 8, 2026 - Affected: fixed in 10.25.5. - Fixed in 10.25.5 (released Apr 7, 2026, 1 day before disclosure). - The latest release, 10.30.1, is not affected. - 24% of liquidjs downloads last week were affected versions (886.8K). ### [CVE-2026-39412](https://cve.now/CVE-2026-39412): LiquidJS has an ownPropertyOnly bypass via sort\_natural filter — prototype property information disclosure through sorting side-channel - Severity: Medium 5.3 - Published: Apr 8, 2026 - Affected: fixed in 10.25.4. - Fixed in 10.25.4 (released Apr 7, 2026, 1 day before disclosure). - The latest release, 10.30.1, is not affected. - 24% of liquidjs downloads last week were affected versions (886.5K). ### [CVE-2026-35525](https://cve.now/CVE-2026-35525): LiquidJS has a root restriction bypass for partial and layout loading through symlinked templates - Severity: High 8.2 - Published: Apr 8, 2026 - Affected: fixed in 10.25.3. - Fixed in 10.25.3 (released Apr 6, 2026, 2 days before disclosure). - The latest release, 10.30.1, is not affected. - 24% of liquidjs downloads last week were affected versions (882.9K). ### [CVE-2026-34166](https://cve.now/CVE-2026-34166): LiquidJS has a Memory Limit Bypass via Quadratic Amplification in \`replace\` Filter - Severity: Low 3.7 - Published: Apr 8, 2026 - Affected: fixed in 10.25.3. - Fixed in 10.25.3 (released Apr 6, 2026, 2 days before disclosure). - The latest release, 10.30.1, is not affected. - 24% of liquidjs downloads last week were affected versions (882.9K). ### [CVE-2026-33285](https://cve.now/CVE-2026-33285): LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash - Severity: High 7.5 - Published: Mar 26, 2026 - Affected: through 10.24.0. - Fixed in 10.25.0 (released Mar 7, 2026, 19 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 10.30.1, is not affected. - 21% of liquidjs downloads last week were affected versions (782.7K). ### [CVE-2026-33287](https://cve.now/CVE-2026-33287): LiquidJS has Exponential Memory Amplification through its replace\_first Filter $& Pattern - Severity: High 7.5 - Published: Mar 26, 2026 - Affected: fixed in 10.25.1. - Fixed in 10.25.1 (released Mar 22, 2026, 4 days before disclosure). - The latest release, 10.30.1, is not affected. - 22% of liquidjs downloads last week were affected versions (817.2K). ### [CVE-2026-30952](https://cve.now/CVE-2026-30952): liquidjs has a path traversal fallback vulnerability - Severity: High 8.7 - Published: Mar 10, 2026 - Affected: fixed in 10.25.0. - Fixed in 10.25.0 (released Mar 7, 2026, 3 days before disclosure). - The latest release, 10.30.1, is not affected. - 21% of liquidjs downloads last week were affected versions (782.7K). ### [CVE-2022-25948](https://cve.now/CVE-2022-25948): Information Exposure - Severity: Medium 5.3 - Published: Dec 23, 2022 - Affected: fixed in 10.0.0. - Fixed in 10.0.0 (released Nov 27, 2022, 26 days before disclosure). - The latest release, 10.30.1, is not affected. - 2.8% of liquidjs downloads last week were affected versions (105.2K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/liquidjs Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.