الرئيسية
الرئيسية
الاتجاهات
الاتجاهات
الثغرات
الثغرات
الأخبار
الأخبار
الباحثون
الباحثون
لماذا dbugs؟
لماذا dbugs؟
الإعدادات

Mfdebian

#50668من 60,387
5.9إجمالي CVSS
الثغرات · 1
PT-2026-89815
2026-09-11
5.9
CVE-2026-87123
Npm
Hbs
An issue exists in the Express view engine wrapper for Handlebars where the Node.js process can crash during output escaping. This occurs when an async helper, registered via `registerAsyncHelper()`, resolves to an object with a `toHTML` property that is truthy but not callable. The `escapeExpression()` function attempts to call `toHTML` as a method, resulting in a TypeError. Because the async substitution executes on a later tick outside the render function's try/catch block, the error becomes an uncaught exception that terminates the process without sending a response. This can be triggered remotely if an async helper resolves to an externally influenced object, such as parsed JSON.