NPM: LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process

🗓️ 08 Sep 2026 18:10:35Reported by PatchstackType

patchstack🔗 patchstack.com👁 3 Views

Uncontrolled resource consumption in LiquidJS join filter bypasses memoryLimit, crashing process.

Reporter	Title	Published	Views	Family All 11
Circl	CVE-2026-69222	8 Sep 202620:35	–	circl
CVE	CVE-2026-69222	19 Aug 202620:51	–	cve
Cvelist	CVE-2026-69222 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process	19 Aug 202620:51	–	cvelist
EUVD	EUVD-2026-63090	8 Sep 202618:10	–	euvd
Github Security Blog	LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process	8 Sep 202618:10	–	github
NVD	CVE-2026-69222	19 Aug 202621:17	–	nvd
OSV	GHSA-4R6H-5V86-94P3 LiquidJS: Uncontrolled Resource Consumption in `join` filter allows template authors to bypass `memoryLimit` and crash the process	8 Sep 202618:10	–	osv
Positive Technologies	PT-2026-78714	19 Aug 202600:00	–	ptsecurity
Snyk	Allocation of Resources Without Limits or Throttling	22 Aug 202605:53	–	snyk
vulnersOsv	@0xtender/events-schema-generator (>=0.0.4, <=0.2.11), @11ty/eleventy (3.0.0-alpha.16) +176 more potentially affected by CVE-2026-69222 via liquidjs (>=10.2.0, <=10.27.1)	22 Aug 202605:53	–	vulnersosv

Vulners

Node

npm liquidjsRange≤10.27.1

Source	Link
github	www.github.com/harttle/liquidjs/security/advisories/GHSA-4r6h-5v86-94p3
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-69222
github	www.github.com/harttle/liquidjs/pull/925
github	www.github.com/harttle/liquidjs/commit/7ab49f999ac045ec1e87f3a7a9fd68dd9e8602b3
github	www.github.com/harttle/liquidjs/releases/tag/v10.27.2
github	www.github.com/advisories/GHSA-4r6h-5v86-94p3

08 Sep 2026 18:10Current

CVSS 3.17.5

EPSS0.00366

SSVC

LiquidJS join filter resource consumption memoryLimit bypass process crash NPM package