CVE-2026-69222

Name of the Vulnerable Software and Affected Versions LiquidJS versions prior to 10.27.2

Description An accounting defect exists in the join filter within src/filters/array.ts and the array to sentence string filter within src/filters/string.ts. The join filter calculates complexity based on array.length and separator length rather than the total string length produced by array.join(sep). When combined with the concat filter, which can efficiently double arrays of references, a template can exceed the configured memoryLimit by a significant factor. This allows a crafted template to allocate memory toward the V8 string or process memory limit, potentially causing the process to crash.

Recommendations Update to version 10.27.2. As a temporary mitigation, restrict the use of the join and array to sentence string filters in templates.