CVE-2026-87123

Name of the Vulnerable Software and Affected Versions hbs version 4.3.0

Description An issue exists in the Express view engine wrapper for Handlebars where the Node.js process can crash during output escaping. This occurs when an async helper, registered via registerAsyncHelper(), resolves to an object with a toHTML property that is truthy but not callable. The escapeExpression() function attempts to call toHTML as a method, resulting in a TypeError. Because the async substitution executes on a later tick outside the render function's try/catch block, the error becomes an uncaught exception that terminates the process without sending a response. This can be triggered remotely if an async helper resolves to an externally influenced object, such as parsed JSON.

Recommendations Update hbs to version 4.3.1 or later.