Skip to content
OpenAdvisories

Package · npm

liquidjs

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Low 3.7
    CVE-2026-34166

    LiquidJS has a Memory Limit Bypass via Quadratic Amplification in `replace` Filter

    LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replace…

    harttle liquidjs liquidjs npm