CVE-2026-34166: Memory Limit Bypass in LiquidJS

The core of the vulnerability lies in the replace filter's inaccurate memory usage calculation. When the memoryLimit option is enabled, the filter incorrectly estimates the memory required for string replacement. An attacker who controls the template content can craft a pattern and replacement string that, when processed, results in a significantly larger output string than initially anticipated. This amplification can be as high as 2,500x, allowing an attacker to bypass the intended memory limit and trigger an out-of-memory error, effectively causing a denial of service. This is particularly concerning in environments where LiquidJS is used to render dynamic content, as malicious templates could be injected to disrupt service.

1. Reserved2026-03-25
2. Published2026-04-08
3. Modified2026-04-09
4. EPSS updated2026-04-16

The primary mitigation for CVE-2026-34166 is to upgrade LiquidJS to version 10.25.3 or later, which includes the corrected memory usage calculation. If upgrading is not immediately feasible, consider implementing stricter input validation on template content to prevent excessively long patterns or replacement strings. While a direct WAF rule is unlikely to be effective due to the nature of the vulnerability, limiting the overall size of template inputs can provide a degree of protection. After upgrading, confirm the fix by testing template rendering with large strings and verifying that the memory limit is enforced as expected.