@nitro/app (>=12.0.0-beta.1, <=12.0.0) potentially affected by CVE-2026-87123 via hbs (4.3.0)

hbs NPM version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on hbs and may be impacted: - @nitro/app =12.0.0-beta.1, =12.0.0 Source cves: CVE-2026-87123 Source advisory: SNYK:JS-HBS-19784397...

Uncaught Exception

Overview hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Uncaught Exception in its async helper output escaping, where a helper value carrying a truthy but non-callable toHTML property causes handlebars' escapeExpression to invoke it ...

CVE-2026-87123

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

@nitro/app (>=12.0.0-beta.1, <=12.0.0) potentially affected by CVE-2026-87123 via hbs (4.3.0)

hbs NPM version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on hbs and may be impacted: - @nitro/app =12.0.0-beta.1, =12.0.0 Source cves: CVE-2026-87123 Source advisory: MEND:CVE-2026-87123...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

EUVD-2026-76029

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123 hbs vulnerable to Denial of Service via unhandled exception in async helper output escaping

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

CVE-2026-87123

hbs is an Express view engine wrapper for Handlebars. In version 4.3.0 , an unhandled TypeError is thrown during output escaping when an async helper (registered via registerAsyncHelper) resolves to an object whose toHTML property is truthy but not callable. Because the async substitution execute...

CVE-2026-87123: Uncaught Exception

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

PT-2026-89815

hbs is an Express view engine wrapper for Handlebars. Version 4.3.0 can crash the Node.js process during output escaping when an async helper, registered with registerAsyncHelper, resolves to an object whose toHTML property is truthy but not callable. Handlebars escapeExpression calls the toHTML...

@adobe/probot-serverless-openwhisk (>=4.0.24, <=4.0.55), @csnext/cs-layer-server (>=0.0.101-beta.22, <=0.0.132-beta.207) +248 more potentially affected by CVE-2026-16231 via hbs (>=2.1.0, <=4.2.1)

hbs NPM version =2.1.0, =4.0.24, =0.0.101-beta.22, =0.7.0, =0.7.0, =0.7.0, =1.0.0, =0.19.0, =2.0.1, =0.1.5, =1.0.36, =0.9.0, =0.0.1-alpha.0, =0.1.2, =0.1.2, =0.3.2 and more Source cves: CVE-2026-16231 Source advisory: SNYK:JS-HBS-19256914...

Cross-site Scripting (XSS)

Overview hbs is an Express.js template engine plugin for Handlebars Affected versions of this package are vulnerable to Cross-site Scripting XSS via the replaceAsyncValues render path in lib/hbs.js. An attacker can inject script into rendered HTML by supplying attacker-controlled data to a...

CVE-2026-16231

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

EUVD-2026-65392

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

@adobe/probot-serverless-openwhisk (>=4.0.24, <=4.0.55), @csnext/cs-layer-server (>=0.0.101-beta.22, <=0.0.132-beta.207) +248 more potentially affected by CVE-2026-16231 via hbs (>=2.1.0, <=4.2.1)

hbs NPM version =2.1.0, =4.0.24, =0.0.101-beta.22, =0.7.0, =0.7.0, =0.7.0, =1.0.0, =0.19.0, =2.0.1, =0.1.5, =1.0.36, =0.9.0, =0.0.1-alpha.0, =0.1.2, =0.1.2, =0.3.2 and more Source cves: CVE-2026-16231 Source advisory: MEND:CVE-2026-16231...

CVE-2026-16231

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...

CVE-2026-16231 hbs vulnerable to XSS via registerAsyncHelper output-escaping bypass

hbs is an Express view engine that wraps Handlebars. Its registerAsyncHelper API bypasses Handlebars' automatic HTML escaping: an async helper returns an opaque placeholder during the first render pass, so the double-brace expression escapes only the placeholder, and after rendering hbs substitut...