Handlebars.js has Denial of Service via Malformed Decorator Syntax in Template Compilation

🗓️ 27 Mar 2026 18:21:15Reported by GitHub Advisory DatabaseType

Unhandled TypeError from unregistered decorator in Handlebars template causes a DoS on single requests.

Reporter	Title	Published	Views	Family All 58
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise Certified Container operands are vulnerable to arbitrary code execution (CVE-2026-33937, CVE-2026-33938, CVE-2026-33940, CVE-2026-33941) and denial of service (CVE-2026-33939)	7 May 202613:34	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM Business Automation Manager Open Editions	24 Apr 202617:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM App Connect Enterprise is vulnerable to multiple vulnerabilities due to multiple node modules.	24 Apr 202614:07	–	ibm
IBM Security Bulletins	Security Bulletin: Platform Navigator and Automation Assets in IBM Cloud Pak for Integration are vulnerable to multiple vulnerabilities in Handlebars	5 May 202609:18	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Spring Security, Handlebars, Apache MINA and Apache Tomcat might affect IBM Storage Defender Copy Data Management	26 Jun 202617:03	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere eXtreme Scale is affected by multiple CVEs	7 Aug 202611:38	–	ibm
ATTACKERKB	CVE-2026-33939	27 Mar 202621:08	–	attackerkb
BDU FSTEC	The vulnerability of the Handlebars template creation tool lies in insufficient checking of unusual or exceptional states, allowing a violator to trigger a service failure.	7 Jul 202600:00	–	bdu_fstec
Chainguard	CVE-2026-33939 vulnerabilities	30 Mar 202619:17	–	cgr
Circl	CVE-2026-33939	26 Mar 202621:00	–	circl

Vulners

Node

handlebars handlebarsRange4.0.0–4.7.8npm

Source	Link
github	www.github.com/handlebars-lang/handlebars.js/security/advisories/GHSA-9cx6-37pm-9jff
github	www.github.com/handlebars-lang/handlebars.js/commit/68d8df5a88e0a26fe9e6084c5c6aaebe67b07da2
github	www.github.com/handlebars-lang/handlebars.js/releases/tag/v4.7.9
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-33939
github	www.github.com/advisories/GHSA-9cx6-37pm-9jff

30 Mar 2026 20:08Current

6Medium risk

Vulners AI Score6

CVSS 3.17.5

EPSS0.00616

SSVC