CVE-2026-45617

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.26.0

Description The built-in strip html filter uses a regular expression containing four flawed lazy-quantified alternatives. When processing input with numerous <script, <style, or <!-- opener tokens that lack matching closers, the V8 regex engine performs quadratic backtracking. This leads to Regular Expression Denial of Service (ReDoS), where the Node.js event loop is blocked, causing severe CPU amplification. For example, a single unauthenticated request of approximately 350 KB can stall the process for about 10 seconds. The default memoryLimit: Infinity configuration does not bound regex CPU usage, and even when configured, the filter only charges the string length to the limit, allowing the regex to run unbounded.

Recommendations Update to version 10.26.0. As a temporary workaround, restrict or avoid using the strip html filter on untrusted user input until the update is applied.