Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Official-Burak

#50727of 60,386
5.9Total CVSS
Vulnerabilities · 1
PT-2026-89815
2026-09-11
5.9
CVE-2026-87123
Npm
Hbs
An issue exists in the Express view engine wrapper for Handlebars where the Node.js process can crash during output escaping. This occurs when an async helper, registered via `registerAsyncHelper()`, resolves to an object with a `toHTML` property that is truthy but not callable. The `escapeExpression()` function attempts to call `toHTML` as a method, resulting in a TypeError. Because the async substitution executes on a later tick outside the render function's try/catch block, the error becomes an uncaught exception that terminates the process without sending a response. This can be triggered remotely if an async helper resolves to an externally influenced object, such as parsed JSON.