CVE-2026-45357

CVE-2026-45357 — LiquidJS date filter (strftime) DoS via unbounded width padding . In LiquidJS

LiquidJS has a memory and render limit bypass via unbounded width padding in `date` filter (strftime)

Summary The date filter's strftime implementation parses width specifiers like %9999999d and forwards the captured width unchecked into pad/padStart in src/util/underscore.ts. The pad loop performs unbounded string concatenation without consulting the Context's memoryLimit or renderLimit, so a...

PT-2026-44154

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.26.0 Description An issue exists in the date filter's strftime implementation where width specifiers, such as %9999999d, are parsed and passed unchecked into the pad and padStart functions. In the...