{"id":80709,"date":"2026-06-18T02:02:20","date_gmt":"2026-06-17T22:32:20","guid":{"rendered":"https:\/\/afaghhosting.net\/blog\/cve-2026-45357-liquidjs-memory-and-render-limit-bypass-via-unbounded-width-padding-in-date-filter-strftime\/"},"modified":"2026-06-18T02:02:20","modified_gmt":"2026-06-17T22:32:20","slug":"cve-2026-45357-liquidjs-memory-and-render-limit-bypass-via-unbounded-width-padding-in-date-filter-strftime","status":"publish","type":"post","link":"https:\/\/afaghhosting.net\/blog\/cve-2026-45357-liquidjs-memory-and-render-limit-bypass-via-unbounded-width-padding-in-date-filter-strftime\/","title":{"rendered":"CVE-2026-45357 &#8211; LiquidJS: Memory and render limit bypass via unbounded width padding in `date` filter (strftime)"},"content":{"rendered":"<p>CVE ID :CVE-2026-45357<\/p>\n<p>  Published : June 17, 2026, 10:32 p.m. | 1\u00a0hour, 10\u00a0minutes ago<\/p>\n<p>  Description :LiquidJS is a Shopify\/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter&#8217;s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()\/padStart(), leading to memory and render limit bypass. In src\/util\/underscore.ts, the pad loop performs unbounded string concatenation without consulting the Context&#8217;s memoryLimit or renderLimit, so a single small template ({{ x | date: &#8216;%5000000d&#8217; }}) produces megabytes of output and unbounded CPU. The memoryLimit and renderLimit options the docs (src\/liquid-options.ts:87-92) advertise as DoS controls \u2014 and which the docstring explicitly mentions for strftime \u2014 are entirely bypassed. Exploitation can cause large memory allocations, high CPU usage, or OOM crashes per render. This issue has been fixed in version 10.26.0.<\/p>\n<p>  Severity: 0.0 | NA<\/p>\n<p>  Visit the link for more details, such as CVSS details, affected products, timeline, and more&#8230;\u00a0<\/p>\n","protected":false},"excerpt":{"rendered":"<p>CVE ID :CVE-2026-45357 Published : June 17, 2026, 10:32 p.m. | 1\u00a0hour, 10\u00a0minutes ago Description :LiquidJS is a Shopify\/GitHub Pages compatible template engine written in pure JavaScript. In versions 10.25.7 and below, the date filter&#8217;s strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad()\/padStart(), leading to memory and render &hellip;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-80709","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/80709","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=80709"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/80709\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=80709"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=80709"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=80709"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}