CVE-2026-16231

Name of the Vulnerable Software and Affected Versions hbs versions 2.1.0 through 4.2.1

Description The registerAsyncHelper API in the hbs Express view engine bypasses the automatic HTML escaping of Handlebars. During the first render pass, an async helper returns an opaque placeholder that is escaped; however, hbs subsequently replaces this placeholder with the raw callback return value without escaping it. This occurs across cached, uncached, and layout render paths. If an application passes attacker-influenced data, such as user-supplied content from a database, into an async helper callback, it can lead to stored or reflected cross-site scripting (XSS), where arbitrary HTML and JavaScript are injected into the server-rendered page.

Recommendations Upgrade to version 4.3.0.